66eea6a7dc64e5a58f9b5f7e4574d966e5919e1991d7c07314affc842e0318c1

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:28

Target

7814c5c3ba9719a7a166da94e772ee30_NeikiAnalytics.dll
Size

81KB
MD5

7814c5c3ba9719a7a166da94e772ee30
SHA1

94ed8297d6b6ac8c34d279cb95fe38a56ad46841
SHA256

66eea6a7dc64e5a58f9b5f7e4574d966e5919e1991d7c07314affc842e0318c1
SHA512

5a0b282880d24b3ec7975c8cce5a6018a7743e75e8bec12b9ce6a30fb61c4ac7f8e843d7326a6cb59726068e3a984e77c0f41b3a1fddc0d7bd7c435ac8448913
SSDEEP

1536:QtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8WX:Q4v4JKXTx71w0ArSsXF3enq8WX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 652 wrote to memory of 2636	652	rundll32.exe	rundll32.exe
PID 652 wrote to memory of 2636	652	rundll32.exe	rundll32.exe
PID 652 wrote to memory of 2636	652	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7814c5c3ba9719a7a166da94e772ee30_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:652

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7814c5c3ba9719a7a166da94e772ee30_NeikiAnalytics.dll,#1
2⤵
PID:2636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3740 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:4636