c90aa2c5e6105057af681bc32b93011ae8c33b9fdecbcfabdb62e60c1fdc190a

Analysis

max time kernel
124s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 11:07

Target

cd69db115a609d5b3d6cfad9f8776c00_NeikiAnalytics.exe
Size

79KB
MD5

cd69db115a609d5b3d6cfad9f8776c00
SHA1

0d28917b6d13f6e5c1073c4b64072b880acb6860
SHA256

c90aa2c5e6105057af681bc32b93011ae8c33b9fdecbcfabdb62e60c1fdc190a
SHA512

0f0bd5fe4323788b85fab160877932f7b8cc5c4e1f344e4169636f5094162e6137916feef4902bbda9861f5aaf191a141b93287f074860058f1a5a279a314582
SSDEEP

1536:zvT7uOoAwg4YQn3COQA8AkqUhMb2nuy5wgIP0CSJ+5y1B8GMGlZ5G:zv+OoT3GdqU7uy5w9WMy1N5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3932	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 4672	2988	cd69db115a609d5b3d6cfad9f8776c00_NeikiAnalytics.exe	90
PID 2988 wrote to memory of 4672	2988	cd69db115a609d5b3d6cfad9f8776c00_NeikiAnalytics.exe	90
PID 2988 wrote to memory of 4672	2988	cd69db115a609d5b3d6cfad9f8776c00_NeikiAnalytics.exe	90
PID 4672 wrote to memory of 3932	4672	cmd.exe	91
PID 4672 wrote to memory of 3932	4672	cmd.exe	91
PID 4672 wrote to memory of 3932	4672	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\cd69db115a609d5b3d6cfad9f8776c00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\cd69db115a609d5b3d6cfad9f8776c00_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:3932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3768,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:8
1⤵
PID:968

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
a98d1075112c536a86ffdbff02ec7ef7

SHA1
bffa490400e9f65a2a5b76a6a2684a6391c3badb

SHA256
8696491f68733d398b20326f41ff9e0e89b0794158887937da8da50141a91f22

SHA512
cc91ed9d7939173c34541bb7183e25712b66e77abbdd6523043dcef1413a170b1da441eed85e1dfb9cf6a087f59f4639ee095d3d619c2c59f89b7913e1f37def

Download Submit
memory/2988-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3932-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download