325d5dfb44b1de74c80f1f7e80259aa30de8b40c3a9a31404bbf48f478a8d363

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 03:32

Target

325d5dfb44b1de74c80f1f7e80259aa30de8b40c3a9a31404bbf48f478a8d363_NeikiAnalytics.dll
Size

6KB
MD5

62d3533c537e88488e790c458a0518e0
SHA1

7ec65b486b7fa82e77c44463bb0e2265eee8016d
SHA256

325d5dfb44b1de74c80f1f7e80259aa30de8b40c3a9a31404bbf48f478a8d363
SHA512

76716ac743c3b3c20aadf94f871a134b2df0d76805878ccba38b1749690232c57ac1d785fbc0d5527f0ff28efe4cb0679998cf6b7aba2041ee955c66ddb28c2a
SSDEEP

48:63mll5YVOa9VUX1iwbQWu0UB+BDq9J5SH:VDa9VUX9bQW0B+FqX5SH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 1152	4964	rundll32.exe	89
PID 4964 wrote to memory of 1152	4964	rundll32.exe	89
PID 4964 wrote to memory of 1152	4964	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\325d5dfb44b1de74c80f1f7e80259aa30de8b40c3a9a31404bbf48f478a8d363_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\325d5dfb44b1de74c80f1f7e80259aa30de8b40c3a9a31404bbf48f478a8d363_NeikiAnalytics.dll,#1
  2⤵
  PID:1152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4004 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:640