0b031b30fb950cdf7b2f2e129a75f11f067b3538825b5fc0035cc90ecaa27863

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 22:07

Target

075d24d49435f95bd3b581a7175d9d10_NeikiAnalytics.dll
Size

6KB
MD5

075d24d49435f95bd3b581a7175d9d10
SHA1

803c59ab60d4e40dccce9d6ff8489d65b70f50a1
SHA256

0b031b30fb950cdf7b2f2e129a75f11f067b3538825b5fc0035cc90ecaa27863
SHA512

7dca649be6ad56f511bdf0259d9eb3e842cc069bca7b85786a76c19aa238110ba56b4aba7bc548a35254b315af5b897ccbe2dacd9e9702646e408d2c5c2c9189
SSDEEP

96:nEY2RrF1eqwi4tFDP2e38BMTMWpBi5SPn3aeZN:EHRh1eppv1Pbi

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 5112	4844	rundll32.exe	89
PID 4844 wrote to memory of 5112	4844	rundll32.exe	89
PID 4844 wrote to memory of 5112	4844	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\075d24d49435f95bd3b581a7175d9d10_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\075d24d49435f95bd3b581a7175d9d10_NeikiAnalytics.dll,#1
  2⤵
  PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4000,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:8
1⤵
PID:3312