6f8180536c95c49428a488f40fac19d9d4416e200501cb92c0fe1d29e6047fc3

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 02:04

Target
55c284f4879cbc7a65f99992847cf2f0_NeikiAnalytics.dll
Size 102KB
Sample240613-cha8nathjl
SHA256 6f8180536c95c49428a488f40fac19d9d4416e200501cb92c0fe1d29e6047fc3
MD5 55c284f4879cbc7a65f99992847cf2f0
SHA1 0e932d6d9a789ee3be5c3ae80c7c50a087ca2636
SHA512 5a8e2cb2fc17814d026a3f2c3b4f1745af57011fd608d6094564a8428e4fcf39f506d90d1bba30d7cf70d8a26711eea6c7f63e16975eea96b1e76269ea3d5e97
SSDEEP 3072:z97vn75AUQtBQYb24WajCJ2DCMqiz6fNzh1:z97vnZQtRAJ2DCM1z6h
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
912	2636	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 2636	648	rundll32.exe	90
PID 648 wrote to memory of 2636	648	rundll32.exe	90
PID 648 wrote to memory of 2636	648	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55c284f4879cbc7a65f99992847cf2f0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\55c284f4879cbc7a65f99992847cf2f0_NeikiAnalytics.dll,#1
  2⤵
  PID:2636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 620
    3⤵
    - Program crash
    PID:912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2636 -ip 2636
1⤵
PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3604 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:2288