f73abebfa3b15c2acf0159561e918d2099316c93fb2cf585aa378f8c981caa38

Analysis

max time kernel
136s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:30

Target
a1d626cbec1e8ef88d72a7f2ff570da0_NeikiAnalytics.dll
Size 160KB
Sample240603-nmemeseb84
SHA256 f73abebfa3b15c2acf0159561e918d2099316c93fb2cf585aa378f8c981caa38
MD5 a1d626cbec1e8ef88d72a7f2ff570da0
SHA1 64297eab85cb7c468bc9fd044182667fe7fc023a
SHA512 78026f6eefb451617c3b778e629fe154198f18a7a50e2abf5697f361abc8bb01c4dc70da8c59ee0c3d901956cc965af10d642c7fa956f0ef64e7fcb29c917cf4
SSDEEP 3072:BbOJ0EL7wzI+MoiCx1a1crhdOzEeEawSVfxF:Bb9Lzci1a1cFdOzWjSVfxF
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 2380	3264	rundll32.exe	91
PID 3264 wrote to memory of 2380	3264	rundll32.exe	91
PID 3264 wrote to memory of 2380	3264	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1d626cbec1e8ef88d72a7f2ff570da0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a1d626cbec1e8ef88d72a7f2ff570da0_NeikiAnalytics.dll,#1
  2⤵
  PID:2380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5164 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:2748