5dbb05e8f7292fd04ba9a97e0d6911bafaec20e8c4a7a7db8b44c54619243be1

Analysis

max time kernel
141s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 15:34

Target

7855821ce5fd94c448bc887b4581f910_NeikiAnalytics.exe
Size

79KB
MD5

7855821ce5fd94c448bc887b4581f910
SHA1

87e8545d5056e3303dd54d9cbc30c42b208bc5ea
SHA256

5dbb05e8f7292fd04ba9a97e0d6911bafaec20e8c4a7a7db8b44c54619243be1
SHA512

4395983abaee8731ce4fb9ab75d7ea30a90ea549980dd7268b08a2802711c6114e7ee0c8576953ff59fa5ca88e59d1e6a5aa1623225ecf2a336c2a4b6258bb15
SSDEEP

1536:zvBuveRBHjUWkOQA8AkqUhMb2nuy5wgIP0CSJ+5yqhGB8GMGlZ5G:zv0WBJBGdqU7uy5w9WMy+GN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2668	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 2440	4656	7855821ce5fd94c448bc887b4581f910_NeikiAnalytics.exe	92
PID 4656 wrote to memory of 2440	4656	7855821ce5fd94c448bc887b4581f910_NeikiAnalytics.exe	92
PID 4656 wrote to memory of 2440	4656	7855821ce5fd94c448bc887b4581f910_NeikiAnalytics.exe	92
PID 2440 wrote to memory of 2668	2440	cmd.exe	93
PID 2440 wrote to memory of 2668	2440	cmd.exe	93
PID 2440 wrote to memory of 2668	2440	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\7855821ce5fd94c448bc887b4581f910_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7855821ce5fd94c448bc887b4581f910_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4148 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:1136

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
2c7bb9bfecc5ceb6d33b0929ac11592e

SHA1
cc5bfde75efe8ed9eb38b1ba0fd41d106b3af705

SHA256
de43ebc9a7b3a48b8c1d606f44f5b1ef62a1719f9e04fab21fe53dc5ff8b8118

SHA512
18c481e2b3aaf1ebbdd93a396c276a9a386ae957863079931bbb731b79b3fefd947180af763a49245a32e7d3b4f29158993de15382bc010ba8cbd349c8c2d195

Download Submit
memory/2668-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4656-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download