1140445eeb5d08df6ddbbf270b1f495ecd8b2fdde6cb718b1842e9ff56bb10ab

Analysis

max time kernel
133s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 12:12

Target
5313f8ea996a7f88a4e6ce4d26625690_NeikiAnalytics.dll
Size 260KB
Sample240529-pddjfaef45
SHA256 1140445eeb5d08df6ddbbf270b1f495ecd8b2fdde6cb718b1842e9ff56bb10ab
MD5 5313f8ea996a7f88a4e6ce4d26625690
SHA1 77ee276d32dd454b031273e1b38989eb66997c03
SHA512 bef3708d4f5ab90b4c1926f7ebc2426f6ee847e50c75f0a25367cfd6f449715c834408365742085ca244759fa2c921e98c6bd648681aaadc0580435f970bfa56
SSDEEP 3072:UCC0euTUTKX9sgAakWuCk6Ah4dTbv4889njByWKZep2+1uBwoXoCDE:UCC0XUOXagAakWubsdnw8J
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5068	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 5068	2040	rundll32.exe	90
PID 2040 wrote to memory of 5068	2040	rundll32.exe	90
PID 2040 wrote to memory of 5068	2040	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5313f8ea996a7f88a4e6ce4d26625690_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5313f8ea996a7f88a4e6ce4d26625690_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4168,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:8
1⤵
PID:3744