009cf6d510966bf6b3b564f88823a00674a103ead6870ea428f7bea103a32fe5

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 10:55

Target

ca1bee1cb2d58a1ebc9d488d73493050_NeikiAnalytics.exe
Size

79KB
MD5

ca1bee1cb2d58a1ebc9d488d73493050
SHA1

ba29d820ede0b161713b5f62c9f0baf33a9e4b39
SHA256

009cf6d510966bf6b3b564f88823a00674a103ead6870ea428f7bea103a32fe5
SHA512

fa7057bbcf8f42346c0a118e6e8d13c61f41698a4ece9be50a00a51f22e44234cfe3065e91b3a41ad45839ad30ab7a9e27019e8137041203caa19682cc1c5235
SSDEEP

1536:zv61XZa5TE6RTSunOQA8AkqUhMb2nuy5wgIP0CSJ+5yPB8GMGlZ5G:zv6Ta5A6RAGdqU7uy5w9WMyPN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
668	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 2076	4924	ca1bee1cb2d58a1ebc9d488d73493050_NeikiAnalytics.exe	92
PID 4924 wrote to memory of 2076	4924	ca1bee1cb2d58a1ebc9d488d73493050_NeikiAnalytics.exe	92
PID 4924 wrote to memory of 2076	4924	ca1bee1cb2d58a1ebc9d488d73493050_NeikiAnalytics.exe	92
PID 2076 wrote to memory of 668	2076	cmd.exe	93
PID 2076 wrote to memory of 668	2076	cmd.exe	93
PID 2076 wrote to memory of 668	2076	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\ca1bee1cb2d58a1ebc9d488d73493050_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ca1bee1cb2d58a1ebc9d488d73493050_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:4432

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
5d7f0655e79e43a66f903c5022dabe8e

SHA1
4dd0c58b400b8dc99421582fe101d739c980e1c4

SHA256
039a9e98d1cae50f56f70471dd4a20b8a0f73392412d33542ee798c5c6ab9193

SHA512
18249a4d821a81dc4bcca9a72063276d6170072b63048add172eef58d82b9005145b86ed789dc86c0dcc93258da043db167f05fb68dc236c41684f4edec1a959

Download Submit
memory/668-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4924-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download