cca806e19aaedf7fd7c2f1256bea772a530f30310d2f512ed59b438eb7d2ec34

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 14:03

Target
a5c2f88ff5774f91b83df3c21b1a3be0_NeikiAnalytics.dll
Size 81KB
Sample240603-rcwpqsgh5y
SHA256 cca806e19aaedf7fd7c2f1256bea772a530f30310d2f512ed59b438eb7d2ec34
MD5 a5c2f88ff5774f91b83df3c21b1a3be0
SHA1 99220dfb3916595f674ccedd61e8960cab8511e7
SHA512 e5c696c74af0413e0ac448fc104d516d406f6d9a76906926913007df97dfc13ba72e67ab58419e69ed219c729933f2a996f82ebc8429493fb4f9b16fad61b194
SSDEEP 1536:BtByXv7uWGEqXZKXTadSp7Lxw9zzBPw+iASUSFOj8sWHcdF7zenq8WY:B4v4JKXTx71w0ArSsXF3enq8WY
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 4644	4728	rundll32.exe	91
PID 4728 wrote to memory of 4644	4728	rundll32.exe	91
PID 4728 wrote to memory of 4644	4728	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5c2f88ff5774f91b83df3c21b1a3be0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a5c2f88ff5774f91b83df3c21b1a3be0_NeikiAnalytics.dll,#1
  2⤵
  PID:4644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:2640