1cf068732ec4a07b65332275e2f02971004d84b4267381728f5cb5e766874c78

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 05:55

Target

355e43b5f767701ecebb0bdd7d444100_NeikiAnalytics.dll
Size

111KB
MD5

355e43b5f767701ecebb0bdd7d444100
SHA1

4995bdda123bab8d670201ab522c7bfa9c17b8d2
SHA256

1cf068732ec4a07b65332275e2f02971004d84b4267381728f5cb5e766874c78
SHA512

a74bb644967eede3091a7806109e9597c5f235e8930836c82c20a4ce1d72df09731faa5d8cffbf4acdc6fb9f3516bcf39f2b4fff71b1430c19f82adc5aa44d58
SSDEEP

3072:xnL7Ot6WLta8ptY9+GRkor1/z6Sbe+jmsPANa:RAtawtYBzr1WthyANa

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 2360	3604	rundll32.exe	91
PID 3604 wrote to memory of 2360	3604	rundll32.exe	91
PID 3604 wrote to memory of 2360	3604	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\355e43b5f767701ecebb0bdd7d444100_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\355e43b5f767701ecebb0bdd7d444100_NeikiAnalytics.dll,#1
  2⤵
  PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:2176