1641f6c01827ac5bec261d776911956e7771fe8527031af949197835fc863466

Analysis

max time kernel
138s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2024, 20:17

Target

1641f6c01827ac5bec261d776911956e7771fe8527031af949197835fc863466_NeikiAnalytics.dll
Size

7KB
MD5

60f75970026d76a28f84125965ff4260
SHA1

7d259e3e5b5a3215c3f2f33a4c193277ac3828d6
SHA256

1641f6c01827ac5bec261d776911956e7771fe8527031af949197835fc863466
SHA512

41dc38398744249c959bc3fd9d9b3d2d9518b7baa4e94ed19e181f619eecf356d6b4a92f908802e3cb43888921cf929ce3445721380bdcadab15d56e16739811
SSDEEP

96:wb4VHccYJUC/aFbz/j0OvaPqd3cX5aXW:wUaJf/aFbP0OB2JaX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 332 wrote to memory of 4528	332	rundll32.exe	92
PID 332 wrote to memory of 4528	332	rundll32.exe	92
PID 332 wrote to memory of 4528	332	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1641f6c01827ac5bec261d776911956e7771fe8527031af949197835fc863466_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1641f6c01827ac5bec261d776911956e7771fe8527031af949197835fc863466_NeikiAnalytics.dll,#1
  2⤵
  PID:4528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:5048