8c4194f27ab1d927e457a5c2cf295d3b859d5a6b00bbb255585ade3bb1718918

Analysis

max time kernel
133s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 08:33

Target

8c4194f27ab1d927e457a5c2cf295d3b859d5a6b00bbb255585ade3bb1718918_NeikiAnalytics.dll
Size

6KB
MD5

2bedee6632b8b0086b91ea9d812d7c80
SHA1

0ed5d3e5e4d7631c65cd558c8d3dd3a392266c93
SHA256

8c4194f27ab1d927e457a5c2cf295d3b859d5a6b00bbb255585ade3bb1718918
SHA512

9f59d1113315700d1e1e18b67d42fbad12dd8290c220be69ea0cd93896feb887052b7b81fc05186a6e0d49ff3e996a0bf5d6c283ad1edd5cbc0b49a7c4ef4757
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0fB+BDq9J5SH:VDa9VUX9bQW/B+FqX5SH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 756	632	rundll32.exe	92
PID 632 wrote to memory of 756	632	rundll32.exe	92
PID 632 wrote to memory of 756	632	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c4194f27ab1d927e457a5c2cf295d3b859d5a6b00bbb255585ade3bb1718918_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c4194f27ab1d927e457a5c2cf295d3b859d5a6b00bbb255585ade3bb1718918_NeikiAnalytics.dll,#1
  2⤵
  PID:756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4344,i,11049150160560877369,2866371920339304689,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:8
1⤵
PID:5044