634e0ef1a0f9de6b25509f55e3af9327b562ea23810182fa242a1bffa6a98829

Analysis

max time kernel
132s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 06:16

Target

5ef884ca1efca46e1c12311d676032e0_NeikiAnalytics.dll
Size

5KB
MD5

5ef884ca1efca46e1c12311d676032e0
SHA1

859affae9c94f33790df779302c923dd8e476414
SHA256

634e0ef1a0f9de6b25509f55e3af9327b562ea23810182fa242a1bffa6a98829
SHA512

8361b7c0ede3ea015b042a64b54e6a99051e346f0ed01a58547a1020e552b868a802e5fb471cdb1494d9e9506d46f8ca5fc069ed8f147130a735a240e13d4f85
SSDEEP

96:hy859x0P8MaE7dXILCfsvAaNfm8b9NB8DKDnOzJfo:F5oLLdYg30B8D8nOF

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 1380	4584	rundll32.exe	90
PID 4584 wrote to memory of 1380	4584	rundll32.exe	90
PID 4584 wrote to memory of 1380	4584	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ef884ca1efca46e1c12311d676032e0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ef884ca1efca46e1c12311d676032e0_NeikiAnalytics.dll,#1
  2⤵
  PID:1380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4048,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8
1⤵
PID:748