62bde539cb5adaaff69d972c18c298fc06ae4431d1a28648509b4b7c398a4616

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 12:34

Target

62bde539cb5adaaff69d972c18c298fc06ae4431d1a28648509b4b7c398a4616_NeikiAnalytics.dll
Size

135KB
MD5

3b63c544db8bccd7a0aa72dc858ce470
SHA1

d104219d4960edf24a98945515ae250e788a15a6
SHA256

62bde539cb5adaaff69d972c18c298fc06ae4431d1a28648509b4b7c398a4616
SHA512

8c0871f01432b31e164ffcf4dd141cee2ee8f1aa712dc8218d553009c6f20a8f131dfee9d66625b2ef2fbc3d7440cf9424084f46f9b8193290de844f7700807b
SSDEEP

3072:lIdf9o9jeLeMB1Owr10xWLJ7tSMgYGhM55c:lIdf9OjlWLRzgYRbc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4648	4672	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 4672	4444	rundll32.exe	91
PID 4444 wrote to memory of 4672	4444	rundll32.exe	91
PID 4444 wrote to memory of 4672	4444	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\62bde539cb5adaaff69d972c18c298fc06ae4431d1a28648509b4b7c398a4616_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\62bde539cb5adaaff69d972c18c298fc06ae4431d1a28648509b4b7c398a4616_NeikiAnalytics.dll,#1
  2⤵
  PID:4672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 600
    3⤵
    - Program crash
    PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4672 -ip 4672
1⤵
PID:1720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3792 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:4600

memory/4672-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download