29aad732537a59d6180b11b934b8c046207f1520124a29335ff95305f5357e67

Analysis

max time kernel
137s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 01:06

Target

29aad732537a59d6180b11b934b8c046207f1520124a29335ff95305f5357e67_NeikiAnalytics.dll
Size

6KB
MD5

2ed2cd531068f5edd825a1ccac85d770
SHA1

85cee7231f27858052ef766ffd08f91c31147de1
SHA256

29aad732537a59d6180b11b934b8c046207f1520124a29335ff95305f5357e67
SHA512

d79078fbb7df4af0faaf6525888656afeb33c65485ab64232ad4f6f7afbb069c0b65ec812e660f31009a8ac177c6d8a337e60f80b3d7bb856e267f62618b295c
SSDEEP

48:6EQt5YVOSVVEPy+wEMmqiHNpU10d/B+BDq9J5SV3DY:CSVVEPozmB7D/B+FqX5S1D

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 4416	3292	rundll32.exe	92
PID 3292 wrote to memory of 4416	3292	rundll32.exe	92
PID 3292 wrote to memory of 4416	3292	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\29aad732537a59d6180b11b934b8c046207f1520124a29335ff95305f5357e67_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\29aad732537a59d6180b11b934b8c046207f1520124a29335ff95305f5357e67_NeikiAnalytics.dll,#1
  2⤵
  PID:4416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:2976