f3ae67df4ce0e39412d360b3475bf31d81f60050f56e6ed10c5628b89f66e498

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 23:35

Target

ffccc40b6bc82c7c654c1c92bf5c9e80_NeikiAnalytics.dll
Size

327KB
MD5

ffccc40b6bc82c7c654c1c92bf5c9e80
SHA1

6535b18992f027d53ee854a30986350c874f8514
SHA256

f3ae67df4ce0e39412d360b3475bf31d81f60050f56e6ed10c5628b89f66e498
SHA512

4be891e124859e9a0e7a89d4c0eec7a0e354fa668f17763dd8e8f62802461a2ac3f919770067f600567b35b2e0d59cc3c88fd79bc5a198bf54cd6036aeae4c55
SSDEEP

6144:EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC48Ss9Ei:EmWhND9yJz+b1FcMLmp2AT8Ssd

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 2348	4948	rundll32.exe	90
PID 4948 wrote to memory of 2348	4948	rundll32.exe	90
PID 4948 wrote to memory of 2348	4948	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffccc40b6bc82c7c654c1c92bf5c9e80_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffccc40b6bc82c7c654c1c92bf5c9e80_NeikiAnalytics.dll,#1
  2⤵
  PID:2348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:4636