cbd224977b9743acc8cf39e6cfd4decc0b4397ee6bf473565284823e2697538f

Analysis

max time kernel
132s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 20:29

Target

0dddc2e64da79bc800db0007c34bc710_NeikiAnalytics.dll
Size

3.4MB
MD5

0dddc2e64da79bc800db0007c34bc710
SHA1

975675ea3d57b555df2f487bf811d7c70a3072b5
SHA256

cbd224977b9743acc8cf39e6cfd4decc0b4397ee6bf473565284823e2697538f
SHA512

9899f33cb1e24f8e8987bb6b51023823ede3c5c98cbb39c581a61d5e6c91608e67c80ef8a377bb1d4959f0e46b05f1232ffbfc568b78dfab63b11ecf64025a50
SSDEEP

98304:xRNhcRNlemriIi0MwI94jJaJ0MPdhXp79AmibNmQn0RVzJ:vL7tFGWPdhXpTQWzJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 2664	1384	rundll32.exe	91
PID 1384 wrote to memory of 2664	1384	rundll32.exe	91
PID 1384 wrote to memory of 2664	1384	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0dddc2e64da79bc800db0007c34bc710_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0dddc2e64da79bc800db0007c34bc710_NeikiAnalytics.dll,#1
  2⤵
  PID:2664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4124,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:8
1⤵
PID:3136