2e6a186fc512d8865e45e69e45816ba5312f7be500e36eef14e2efec9c51d650

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 02:23

Target

2e6a186fc512d8865e45e69e45816ba5312f7be500e36eef14e2efec9c51d650_NeikiAnalytics.dll
Size

529KB
MD5

5f35715e9bb7ff41874fd78d8771d810
SHA1

1f5ea89babcadff70f24315e7200272db3435b83
SHA256

2e6a186fc512d8865e45e69e45816ba5312f7be500e36eef14e2efec9c51d650
SHA512

3e14324caa27f31069824d5af59b32a976dcc888f7d40698394808e83ed4adb331993db012d0962732c109f7423428c84a487d59d455382bfd29d9179223c153
SSDEEP

12288:vxX+wKFLWjVSngYlNT/6vY/D3zMLNP6SHn:vQwO4/rQO6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 4148	1964	regsvr32.exe	91
PID 1964 wrote to memory of 4148	1964	regsvr32.exe	91
PID 1964 wrote to memory of 4148	1964	regsvr32.exe	91

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2e6a186fc512d8865e45e69e45816ba5312f7be500e36eef14e2efec9c51d650_NeikiAnalytics.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\2e6a186fc512d8865e45e69e45816ba5312f7be500e36eef14e2efec9c51d650_NeikiAnalytics.dll
  2⤵
  PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:3752