670c44275aeba554552be1fb8623d16a81ae00526f40bb467e4acd25a9cd246a

Analysis

max time kernel
142s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 21:06

Target

894d6add2d197a66b8ca6f57e090a7e0_NeikiAnalytics.exe
Size

899KB
MD5

894d6add2d197a66b8ca6f57e090a7e0
SHA1

5f5f2dd0440ba12bf6317f63d22c3861384fb1b6
SHA256

670c44275aeba554552be1fb8623d16a81ae00526f40bb467e4acd25a9cd246a
SHA512

c52e24aea6c5f157aacc378c0ac5ae035799fb37f732504b1901828483d5eb714df7ee4e6242a008dec48292cce9961534b5fb5e5064bdd82f8ec9ebf6355b9b
SSDEEP

12288:qNV6C+RE0DDz/viiuFg4M/lGhN+Tm6rnn8p1ZtVbFz985PMthq2QX9OC2pcHters:qNV6Ci/zniiiqlTnn0j

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
648	894d6add2d197a66b8ca6f57e090a7e0_NeikiAnalytics.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 648 set thread context of 864	648	894d6add2d197a66b8ca6f57e090a7e0_NeikiAnalytics.exe	91

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 864	648	894d6add2d197a66b8ca6f57e090a7e0_NeikiAnalytics.exe	91
PID 648 wrote to memory of 864	648	894d6add2d197a66b8ca6f57e090a7e0_NeikiAnalytics.exe	91
PID 648 wrote to memory of 864	648	894d6add2d197a66b8ca6f57e090a7e0_NeikiAnalytics.exe	91
PID 648 wrote to memory of 864	648	894d6add2d197a66b8ca6f57e090a7e0_NeikiAnalytics.exe	91
PID 648 wrote to memory of 864	648	894d6add2d197a66b8ca6f57e090a7e0_NeikiAnalytics.exe	91
PID 648 wrote to memory of 864	648	894d6add2d197a66b8ca6f57e090a7e0_NeikiAnalytics.exe	91
PID 648 wrote to memory of 864	648	894d6add2d197a66b8ca6f57e090a7e0_NeikiAnalytics.exe	91
PID 648 wrote to memory of 864	648	894d6add2d197a66b8ca6f57e090a7e0_NeikiAnalytics.exe	91
PID 648 wrote to memory of 864	648	894d6add2d197a66b8ca6f57e090a7e0_NeikiAnalytics.exe	91

C:\Users\Admin\AppData\Local\Temp\894d6add2d197a66b8ca6f57e090a7e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\894d6add2d197a66b8ca6f57e090a7e0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:648
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  PID:864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:3412

C:\Users\Admin\AppData\Roaming\d3d9.dll

Filesize
405KB

MD5
805575552ac81efdabe64fb49646cb76

SHA1
f9db24de8b27d150ed15e85d24c1e1274629558c

SHA256
2d38f96277d8f0eb5e07d8d362a4825d8824bd183a13ba71d5c0e3e4bcbb1996

SHA512
2df55c3ee79850cf1124b7e891643ad4232688bc5ea4d310cbe848d1f1e90e5d08a15d7f011f6e22e46a8cec590e782c18f03eb3caf1b19150c5b0a725fb8747

Download Submit
memory/648-0-0x0000000074F3E000-0x0000000074F3F000-memory.dmp

Filesize
4KB

Download
memory/648-1-0x0000000000040000-0x000000000012A000-memory.dmp

Filesize
936KB

Download
memory/648-2-0x00000000023D0000-0x00000000023D6000-memory.dmp

Filesize
24KB

Download
memory/648-3-0x0000000074F30000-0x00000000756E0000-memory.dmp

Filesize
7.7MB

Download
memory/648-14-0x0000000074F30000-0x00000000756E0000-memory.dmp

Filesize
7.7MB

Download
memory/864-9-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/864-12-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/864-13-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/864-15-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download