503f28f3d3c24dfe7d6d3ea7b36363c3812359c8dfa64dfb734f9d91b819a3c6

Analysis

max time kernel
113s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 04:57

Target

503f28f3d3c24dfe7d6d3ea7b36363c3812359c8dfa64dfb734f9d91b819a3c6_NeikiAnalytics.dll
Size

6KB
MD5

455a2880ec9e3a6a6358482309300de0
SHA1

5e0788095a5ceb6332f7dbc475c59b013aa4fbb7
SHA256

503f28f3d3c24dfe7d6d3ea7b36363c3812359c8dfa64dfb734f9d91b819a3c6
SHA512

ed43782ab61ccef2db6e6900d961e20cd304f49677be9872a83c56fca0ba875492a9e3663c0d18ac1ca6554d382a5e0592ea0d2afbcb9158b7a77d068deda413
SSDEEP

96:hy859x0P8Ma77/1TU1GVmP2UizO7wdr2FTy8VDq1V:F5oL67BpVmeUizO7wdiFTy8t0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 4068	4300	rundll32.exe	90
PID 4300 wrote to memory of 4068	4300	rundll32.exe	90
PID 4300 wrote to memory of 4068	4300	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\503f28f3d3c24dfe7d6d3ea7b36363c3812359c8dfa64dfb734f9d91b819a3c6_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\503f28f3d3c24dfe7d6d3ea7b36363c3812359c8dfa64dfb734f9d91b819a3c6_NeikiAnalytics.dll,#1
  2⤵
  PID:4068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:5116