ccf12a0c99af6160a40be585af145f1fac7956abd113b0b8c6648988a18937c7

Analysis

max time kernel
135s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 00:18

Target
8a584656cff931df0d9dd19c0f72b3a0_NeikiAnalytics.dll
Size 83KB
Sample240603-aly3sadf39
SHA256 ccf12a0c99af6160a40be585af145f1fac7956abd113b0b8c6648988a18937c7
MD5 8a584656cff931df0d9dd19c0f72b3a0
SHA1 36b63dd2a25eeecd15010d8b36276f7c82b4bd2c
SHA512 a1b8c8a2da9ebbe4624dab937723dcb91b75b5cc1b3b025312a38721e70fd431dc968b97d139404ac693e9d42674e6a20cbd070134fe79e62d145a6c4ffe3d42
SSDEEP 1536:5JAooe4Y8mEScroVd0O/KaTHgMLXnrtGqtk5B6:TArE8pQH5tk5k
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1348	2372	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 2372	3556	rundll32.exe	90
PID 3556 wrote to memory of 2372	3556	rundll32.exe	90
PID 3556 wrote to memory of 2372	3556	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a584656cff931df0d9dd19c0f72b3a0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a584656cff931df0d9dd19c0f72b3a0_NeikiAnalytics.dll,#1
  2⤵
  PID:2372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 624
    3⤵
    - Program crash
    PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2372 -ip 2372
1⤵
PID:1408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3128,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
1⤵
PID:632