2f0470ab501bd61a59371d8226eeaf4cd2f8720a65f017d4abfac5064a497f27

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 10:12

Target

5098043a0b6091007020eef06457a640_NeikiAnalytics.dll
Size

334KB
MD5

5098043a0b6091007020eef06457a640
SHA1

17d47b2c8a3f98de529252fe30e11730778a2cf5
SHA256

2f0470ab501bd61a59371d8226eeaf4cd2f8720a65f017d4abfac5064a497f27
SHA512

8a79e0d429fcf6f82bc8bcf96de1370a44b8d282bcdb75c843091ed8fae6a7455ff9cf55c6991a7082ddba12ada9b9b7d54620a916f0a1c8951922593f825247
SSDEEP

6144:Ej1rke7ZTWm4vbonyerSpiRBbKQzdE7SuSqLqT8vFzXaWdW3yR9:Ske1TWxONRBb7zd0SlqWT8vFuRyR9

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 2260	792	rundll32.exe	90
PID 792 wrote to memory of 2260	792	rundll32.exe	90
PID 792 wrote to memory of 2260	792	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5098043a0b6091007020eef06457a640_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5098043a0b6091007020eef06457a640_NeikiAnalytics.dll,#1
  2⤵
  PID:2260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3768 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:4148