85e31e68a034235f89f5250ebf78c7dfaf81ca4b2471aebb2cf001bcf1b90213

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 09:01

Target
6ef34b65e98eee369e8095aa976a6d90_NeikiAnalytics.dll
Size 81KB
Sample240613-kzamfssbmf
SHA256 85e31e68a034235f89f5250ebf78c7dfaf81ca4b2471aebb2cf001bcf1b90213
MD5 6ef34b65e98eee369e8095aa976a6d90
SHA1 a2ab5589ead1f81deefa44999a99dbc805c72dfc
SHA512 4009ba4855b329cbd1c029d71ec5a9b5787de6dceb02e734b3545a358500e9bdd5bf0a15e0d13f895f977b58d1ce1ada0ee8ba977ec32b0cfe9a9a5f5cf86791
SSDEEP 1536:ic+UPvS0RKCmqAvj45Hx8u05iecuYSoosWaocdBkez0U+GB:h+5oxmqAiR8+/RBkez0U+C
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 1864	1012	rundll32.exe	89
PID 1012 wrote to memory of 1864	1012	rundll32.exe	89
PID 1012 wrote to memory of 1864	1012	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ef34b65e98eee369e8095aa976a6d90_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ef34b65e98eee369e8095aa976a6d90_NeikiAnalytics.dll,#1
  2⤵
  PID:1864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3884,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:8
1⤵
PID:4388