65f2de9d9df3bcb277be2200eee00a0ca2be682c37555785ba48f2919185be16

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 07:05

Target

9f21d126effd56b867821a751395c020_NeikiAnalytics.exe
Size

5.4MB
MD5

9f21d126effd56b867821a751395c020
SHA1

9589880e4cde2a2bb7492204f386db0679eca8d7
SHA256

65f2de9d9df3bcb277be2200eee00a0ca2be682c37555785ba48f2919185be16
SHA512

f7a48814a71499a9dbaf288f1790ab4ba154413a750a1ab4633593f8dad8130fc7b0b3be25698b27c717741385743cff2fc510bf3d48e54078a309915bce2754
SSDEEP

98304:emhd1UryezDnWfKLJpvATE20HV7wQqZUha5jtSyZIUh:elfWfKMw2QbaZtliU

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4464	AB9.tmp

Executes dropped EXE 1 IoCs

pid	Process
4464	AB9.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 4464	1904	9f21d126effd56b867821a751395c020_NeikiAnalytics.exe	90
PID 1904 wrote to memory of 4464	1904	9f21d126effd56b867821a751395c020_NeikiAnalytics.exe	90
PID 1904 wrote to memory of 4464	1904	9f21d126effd56b867821a751395c020_NeikiAnalytics.exe	90

C:\Users\Admin\AppData\Local\Temp\9f21d126effd56b867821a751395c020_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9f21d126effd56b867821a751395c020_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Users\Admin\AppData\Local\Temp\AB9.tmp
  "C:\Users\Admin\AppData\Local\Temp\AB9.tmp" --splashC:\Users\Admin\AppData\Local\Temp\9f21d126effd56b867821a751395c020_NeikiAnalytics.exe 5BC8E03E0E65C54A64C650823004D72ADFD43CD57A1CC47ED7003B4657138641A213EBAC3B6D4BBCDB9BBB328073BC709B2471E25AA544C1AACAA184DECB6F90
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3552 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:2256

C:\Users\Admin\AppData\Local\Temp\AB9.tmp

Filesize
5.4MB

MD5
144c15abb76b07b6699cb66014e01520

SHA1
30066fbda2d568b7067b34c02dd610ce61178320

SHA256
0279f515da21827af7b70f8a40a70193b7381171df63a3a7ec5d02fe1771737c

SHA512
587b5345cded0d2bfefc6988a5826fd24f7c56f587653b73483601f95e5363796de155f5820892ece173d90bf95e5ad0cd8e24096f0473bd0dace7cb376d1c54

Download Submit
memory/1904-0-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download
memory/4464-5-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download