cc75197fb824f8ecaa5ba990c2eabe96c1bad70b40f42f81d90eab1f6e107fbc

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 11:11

Target

ce58361ae0b2d2926dde60029d6309b0_NeikiAnalytics.exe
Size

79KB
MD5

ce58361ae0b2d2926dde60029d6309b0
SHA1

510678edd95678e75ad9757ec6ba95cbd4a148ab
SHA256

cc75197fb824f8ecaa5ba990c2eabe96c1bad70b40f42f81d90eab1f6e107fbc
SHA512

654e5506bb1f35d1207cbd135ffee01e4c8a9597b9281a17a7a628edfc9779f8cfb7c96f89b3b9e92a8abe68c0b088fdc90fcc1995ef08595a75b697ac5b3ea2
SSDEEP

1536:zvO/iWQN7sVqtRZuuOQA8AkqUhMb2nuy5wgIP0CSJ+5ypB8GMGlZ5G:zvO6LP7Z+GdqU7uy5w9WMypN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1412	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 5048	4836	ce58361ae0b2d2926dde60029d6309b0_NeikiAnalytics.exe	91
PID 4836 wrote to memory of 5048	4836	ce58361ae0b2d2926dde60029d6309b0_NeikiAnalytics.exe	91
PID 4836 wrote to memory of 5048	4836	ce58361ae0b2d2926dde60029d6309b0_NeikiAnalytics.exe	91
PID 5048 wrote to memory of 1412	5048	cmd.exe	92
PID 5048 wrote to memory of 1412	5048	cmd.exe	92
PID 5048 wrote to memory of 1412	5048	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\ce58361ae0b2d2926dde60029d6309b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ce58361ae0b2d2926dde60029d6309b0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:1412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4276,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:8
1⤵
PID:3308

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
ff38113234dd932571b3b6456a39423d

SHA1
ced4ba7f7cd9bd8d8f3d6149e48b4a31d658de40

SHA256
b41f9e5c8753e2110e13ee4a7f4ada265d88929696c724c7750d3d8cf661ba41

SHA512
5e0fe2e8ef89455badf42eb580721f8c543039ee89268b5154908bc32b67b106419cafebb2a7ad15de7aed176e605bbf0e56cc45ef2dc277f8b5b5cf44474138

Download Submit
memory/1412-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4836-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download