2871a00323f9b80c672b970ee2561ade3c14aaf47f97eef535e0ac6337ed36ad

Analysis

max time kernel
132s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
26/06/2024, 00:05

Target

2871a00323f9b80c672b970ee2561ade3c14aaf47f97eef535e0ac6337ed36ad_NeikiAnalytics.dll
Size

5KB
MD5

9fbbde8813fdc618ad82def17b11b160
SHA1

b72b15f32a6a31d968016b375259ff2f122c5b87
SHA256

2871a00323f9b80c672b970ee2561ade3c14aaf47f97eef535e0ac6337ed36ad
SHA512

61dca46a26130377b3da46aa0842e5ca8594132dfde328b9d9fc998069dd8a23b6294fcef2c34a9d39a62ee920e22873dcf99bcb7a9c6debfd46a93448e692c3
SSDEEP

96:hy859x0P8MaLxeW1DJfM2qw45NeS5miAcphQINn:F5oLyxeWtN2fjeUm+p

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 4020	1832	rundll32.exe	92
PID 1832 wrote to memory of 4020	1832	rundll32.exe	92
PID 1832 wrote to memory of 4020	1832	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2871a00323f9b80c672b970ee2561ade3c14aaf47f97eef535e0ac6337ed36ad_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2871a00323f9b80c672b970ee2561ade3c14aaf47f97eef535e0ac6337ed36ad_NeikiAnalytics.dll,#1
  2⤵
  PID:4020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4648,i,16866810346450717340,3849854439116899380,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
1⤵
PID:1516