9a497393a5dfc71d1fa263edeec658c45f10a177a6ed763d69345616d947a87e

Analysis

max time kernel
133s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 09:53

Target

9a497393a5dfc71d1fa263edeec658c45f10a177a6ed763d69345616d947a87e_NeikiAnalytics.dll
Size

6KB
MD5

225bf91eb8e69119e51e373e8ee54870
SHA1

c7bdf47698d730d1bfa46c8c8e224800ef7f3080
SHA256

9a497393a5dfc71d1fa263edeec658c45f10a177a6ed763d69345616d947a87e
SHA512

3db4e114d9063921252aa43d29ebfe36654965ef189764e4418eb7181cc93a93a13f89bac976a21c93c73c89c93fa9c42ed99f8944b6424c06ef4ab9be4c18a8
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0nB+BDq9J5SH:VDa9VUX9bQWHB+FqX5SH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 1652	3464	rundll32.exe	90
PID 3464 wrote to memory of 1652	3464	rundll32.exe	90
PID 3464 wrote to memory of 1652	3464	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a497393a5dfc71d1fa263edeec658c45f10a177a6ed763d69345616d947a87e_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a497393a5dfc71d1fa263edeec658c45f10a177a6ed763d69345616d947a87e_NeikiAnalytics.dll,#1
  2⤵
  PID:1652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4472,i,7869973516895866428,11647313872437892197,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
1⤵
PID:4860