da63f66be206768ed466fd3dd0bbf81450835b13edc6e1fc9b6c2651c15f8cc2

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 09:34

Target
70d3d29db6cc42cf79d0c913da035eb0_NeikiAnalytics.dll
Size 81KB
Sample240613-ljqt6sshmg
SHA256 da63f66be206768ed466fd3dd0bbf81450835b13edc6e1fc9b6c2651c15f8cc2
MD5 70d3d29db6cc42cf79d0c913da035eb0
SHA1 0e6d5631f698640013c16510eaf4c4e5e4573439
SHA512 b8d5ba2e975647610b8f0baa950d2d5fbb0559cdf91210b15b4d64403e16d94db2f4e6b2f041928d0f3805124a0f016949b215972dd0de0775a76424d1654748
SSDEEP 1536:7w6i4aG36UbtIjESu4u/Ejc6uCiN2f+BrSfqfOj8sWHcdSx4uX+UWt:7vi4qUbu4Su4u/E46OrAqKXSx4uOUWt
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2736	2800	rundll32.exe	89
PID 2800 wrote to memory of 2736	2800	rundll32.exe	89
PID 2800 wrote to memory of 2736	2800	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\70d3d29db6cc42cf79d0c913da035eb0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\70d3d29db6cc42cf79d0c913da035eb0_NeikiAnalytics.dll,#1
  2⤵
  PID:2736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4216,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
1⤵
PID:3964