acba73db5c42c692a1c93b002d2455c24607b0c952716975bf30746ca09c77bd

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 13:07

Target

acba73db5c42c692a1c93b002d2455c24607b0c952716975bf30746ca09c77bd_NeikiAnalytics.dll
Size

331KB
MD5

998f7e2f8b145f5200cd417e98923e90
SHA1

5123bc41c3e79229d563d351522398180a96854f
SHA256

acba73db5c42c692a1c93b002d2455c24607b0c952716975bf30746ca09c77bd
SHA512

f3c883a83f918e7a45d9039a411f083f987abcc4a9194412e68d5f65533aac51b307156d169be8019752a1c3d2a011f3dc6632ff859613adc443635b1c0e09b5
SSDEEP

6144:gepnKlhOTa4VxgOEupCigyM/NXhwFgdy+7dV39BfanT+6vQNarKm4p3uCsQgSThZ:LghOnb9DgD1X+/+Jt9BfanT+6vQNarKZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4916	1672	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 1672	4728	rundll32.exe	89
PID 4728 wrote to memory of 1672	4728	rundll32.exe	89
PID 4728 wrote to memory of 1672	4728	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\acba73db5c42c692a1c93b002d2455c24607b0c952716975bf30746ca09c77bd_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\acba73db5c42c692a1c93b002d2455c24607b0c952716975bf30746ca09c77bd_NeikiAnalytics.dll,#1
  2⤵
  PID:1672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 564
    3⤵
    - Program crash
    PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1672 -ip 1672
1⤵
PID:624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1288,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:8
1⤵
PID:4136