9c7a6b2998003c304484555f8abf466afbb6eb41ca07045e9f4cd2b285707ef5

Analysis

max time kernel
139s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 03:58

Target

653419bb4f788667cd95b80d86b7cab0_NeikiAnalytics.exe
Size

79KB
MD5

653419bb4f788667cd95b80d86b7cab0
SHA1

feda12c27ac15ed7aa56519e58af68eb858609ea
SHA256

9c7a6b2998003c304484555f8abf466afbb6eb41ca07045e9f4cd2b285707ef5
SHA512

728503be5844ec5f21da838e55244892e622fdd89045048adc5f56d7e7a95dbd24494443f8d47f2f7ab492ec976599464ba68019f5c6bcbaf55b56850e2b81ab
SSDEEP

1536:zvZVIhoOFZ2OQA8AkqUhMb2nuy5wgIP0CSJ+5yHB8GMGlZ5G:zvrIGO/TGdqU7uy5w9WMyHN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2452	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 1964	4416	653419bb4f788667cd95b80d86b7cab0_NeikiAnalytics.exe	92
PID 4416 wrote to memory of 1964	4416	653419bb4f788667cd95b80d86b7cab0_NeikiAnalytics.exe	92
PID 4416 wrote to memory of 1964	4416	653419bb4f788667cd95b80d86b7cab0_NeikiAnalytics.exe	92
PID 1964 wrote to memory of 2452	1964	cmd.exe	93
PID 1964 wrote to memory of 2452	1964	cmd.exe	93
PID 1964 wrote to memory of 2452	1964	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\653419bb4f788667cd95b80d86b7cab0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\653419bb4f788667cd95b80d86b7cab0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4444 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:2352

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
2ba3d0a8e83a45bee74d6dc83b24bcbe

SHA1
832f48c5edd2a0e43a5f8dc7d872422579510539

SHA256
7aa1b319e186ae6c3116ce8f6803238affac36f869af2721cbd2de6b228014c7

SHA512
74a6ed5d87368236e303a4f759db9cfe70a01305d8fb1b6e9d0888767b57cf7649883d3351a7c5ee2e920785703f0da7e9595429a4bcea0017c596979ceb0c34

Download Submit
memory/2452-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4416-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4416-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download