c78f66251212a4a0bf8294123375e043be0b9a2d75dce4285c9bc95ef03fe3be

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 01:17

Target

398d070edadd5755a18ee7742b644710_NeikiAnalytics.exe
Size

65KB
MD5

398d070edadd5755a18ee7742b644710
SHA1

bf5deb35ae81816b5377820c5446b8eaba1a4888
SHA256

c78f66251212a4a0bf8294123375e043be0b9a2d75dce4285c9bc95ef03fe3be
SHA512

6c7255d4d0591c35cd38ba4fe3514e9427b7addc23b0bda79f3c147ebcd05ed9f8d1b6a77a018c47bd855b3a7a8fe65d55599c1fc1b2a8e0092d71ba59fa6920
SSDEEP

1536:Gttose4OcUm3QI5EPZo6E5sEFd29NQgA2w6TNle5c:eose4O+QZo6EKEFdGM29le5c

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
2360	ewiuer2.exe
2860	ewiuer2.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\viesazm.mpk	ewiuer2.exe
File created	C:\Windows\SysWOW64\ewiuer2.exe	ewiuer2.exe
File created	C:\Windows\SysWOW64\ewiuer2.exe	ewiuer2.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2360	2388	398d070edadd5755a18ee7742b644710_NeikiAnalytics.exe	91
PID 2388 wrote to memory of 2360	2388	398d070edadd5755a18ee7742b644710_NeikiAnalytics.exe	91
PID 2388 wrote to memory of 2360	2388	398d070edadd5755a18ee7742b644710_NeikiAnalytics.exe	91
PID 2360 wrote to memory of 2860	2360	ewiuer2.exe	101
PID 2360 wrote to memory of 2860	2360	ewiuer2.exe	101
PID 2360 wrote to memory of 2860	2360	ewiuer2.exe	101

C:\Users\Admin\AppData\Local\Temp\398d070edadd5755a18ee7742b644710_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\398d070edadd5755a18ee7742b644710_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Roaming\ewiuer2.exe
  C:\Users\Admin\AppData\Roaming\ewiuer2.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\SysWOW64\ewiuer2.exe
    C:\Windows\System32\ewiuer2.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:2860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3956 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:5056

C:\Users\Admin\AppData\Roaming\ewiuer2.exe

Filesize
65KB

MD5
f4d210d12620db265e8021e0337f47cf

SHA1
7b7496f2906b99bc7062718dc60b9cf29e7276fb

SHA256
f40ea3a8d8cc5199a2d65201ca33b88ae9517924c0f4c513d0aa9553e7694bd0

SHA512
6445490fb631af59124de88326ba34fc5e0eb261dbcf3b0618ff4efb7a39c8af72975e44e553fc42062745ed9fb3e4dcbc2f74adc2005099bf6e8868c788dc49

Download Submit
C:\Windows\SysWOW64\ewiuer2.exe

Filesize
65KB

MD5
b462585bcf6f3ed0940437c06ebcb65e

SHA1
9adbd3c85f7cfdbeb7c30fa75435247da84240fd

SHA256
71618f634828a207091b3e1adb65748d932852c3cd79549ba5adb1c43ff6310a

SHA512
9608e48366ea53db20a3ced8b0d0b438d2053ee4058cdf2ee6df243014fbca2280047fe42dee6eb4d723a47245f028935ad53a31dfe48a4679818a688a6ea751

Download Submit
memory/2360-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2360-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2360-13-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2388-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2388-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2860-11-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2860-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download