faca9fd21b087b6ae9067df3df0b5d57d20d4ae187f7e996df968dc2a899e917

Analysis

max time kernel
138s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 06:38

Target
5b5de504f2abc06a4ee0cf1237f85140_NeikiAnalytics.dll
Size 1.1MB
Sample240617-heg5pasfmj
SHA256 faca9fd21b087b6ae9067df3df0b5d57d20d4ae187f7e996df968dc2a899e917
MD5 5b5de504f2abc06a4ee0cf1237f85140
SHA1 a3d75647167d369bf4a8ddb68b819c042919b168
SHA512 72a1416031e6c0a1e38f2e2a87cbad58a6b90ed84463778c0b8c0c2fff6259e634776b669c6f150fbd96b3f14beb8c135ee21fdafeb38c335be72df87c946985
SSDEEP 24576:FIIIGnOmYtxbXbbpG3EXq6MS/uv2bknMhTDYh+tz4+Iwr:FxnOf1vpG3EXq6t/Xo8S4z4+Iw
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 4884	5112	rundll32.exe	91
PID 5112 wrote to memory of 4884	5112	rundll32.exe	91
PID 5112 wrote to memory of 4884	5112	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b5de504f2abc06a4ee0cf1237f85140_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5b5de504f2abc06a4ee0cf1237f85140_NeikiAnalytics.dll,#1
  2⤵
  PID:4884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:2908