14e8b7fe64d4b466aba87b6f4eea6743df6f3c633214e76e79e56214695a88c0

Analysis

max time kernel
141s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 22:13

Target

96290537885c36544a366bf41a29ff00_NeikiAnalytics.exe
Size

2.6MB
MD5

96290537885c36544a366bf41a29ff00
SHA1

427e4cd7a4c9fd02074b4a560c06d94997569340
SHA256

14e8b7fe64d4b466aba87b6f4eea6743df6f3c633214e76e79e56214695a88c0
SHA512

37040f4faa87607acc3e13dfce632e46505a376a4b48e94509240c3050add31c672c40e06b2590b2c494dc1acc5588a86db40d2f5758be5f9da8bd55e5eaf9e9
SSDEEP

49152:lSqI2Lj9eY+WTXqUlqZbj+wFPTnNd00Ee9jTFO5vAse8d8YU26jH3HdpF:QGevW79UZf+wFP5/lTM54sv/U26z39z

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/624-0-0x0000000000400000-0x0000000000D25000-memory.dmp	upx
behavioral2/memory/624-8-0x0000000000400000-0x0000000000D25000-memory.dmp	upx
behavioral2/memory/624-19-0x0000000000400000-0x0000000000D25000-memory.dmp	upx

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 4140	624	96290537885c36544a366bf41a29ff00_NeikiAnalytics.exe	94
PID 624 wrote to memory of 4140	624	96290537885c36544a366bf41a29ff00_NeikiAnalytics.exe	94

C:\Users\Admin\AppData\Local\Temp\96290537885c36544a366bf41a29ff00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\96290537885c36544a366bf41a29ff00_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:4140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4180,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
1⤵
PID:864

memory/624-0-0x0000000000400000-0x0000000000D25000-memory.dmp

Filesize
9.1MB

Download
memory/624-1-0x0000000001320000-0x0000000001321000-memory.dmp

Filesize
4KB

Download
memory/624-2-0x0000000004F30000-0x0000000004F31000-memory.dmp

Filesize
4KB

Download
memory/624-3-0x0000000005C50000-0x0000000005C51000-memory.dmp

Filesize
4KB

Download
memory/624-4-0x0000000005D60000-0x0000000005D61000-memory.dmp

Filesize
4KB

Download
memory/624-5-0x00000000060C0000-0x00000000060C1000-memory.dmp

Filesize
4KB

Download
memory/624-6-0x0000000006B10000-0x0000000006B11000-memory.dmp

Filesize
4KB

Download
memory/624-8-0x0000000000400000-0x0000000000D25000-memory.dmp

Filesize
9.1MB

Download
memory/624-9-0x0000000001320000-0x0000000001321000-memory.dmp

Filesize
4KB

Download
memory/624-10-0x0000000004F30000-0x0000000004F31000-memory.dmp

Filesize
4KB

Download
memory/624-11-0x0000000005C50000-0x0000000005C51000-memory.dmp

Filesize
4KB

Download
memory/624-13-0x0000000005D60000-0x0000000005D61000-memory.dmp

Filesize
4KB

Download
memory/624-14-0x00000000060C0000-0x00000000060C1000-memory.dmp

Filesize
4KB

Download
memory/624-15-0x0000000006B10000-0x0000000006B11000-memory.dmp

Filesize
4KB

Download
memory/624-19-0x0000000000400000-0x0000000000D25000-memory.dmp

Filesize
9.1MB

Download