eb5049632654d5687148b8c82db7e54ca5d2a5f8981d9048cc6f63b23b04f72a

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 02:43

Target
0fe591834431f52ca459aacfda3bf5c0_NeikiAnalytics.exe
Size 79KB
Sample240525-c7pscaca48
SHA256 eb5049632654d5687148b8c82db7e54ca5d2a5f8981d9048cc6f63b23b04f72a
MD5 0fe591834431f52ca459aacfda3bf5c0
SHA1 1a8beeea0a598e252710bd480f980877c3991d7b
SHA512 8b33f91c9c87cf82b6b62b9d1bd7fd3646711a2fdbd8336e91d5e5067adaa87cdaab1eb1784faded10a723e72b6572efb2203f1de40f7a463baebcb5277ec6f4
SSDEEP 1536:zvqdANke+cTyY27OQA8AkqUhMb2nuy5wgIP0CSJ+5yCB8GMGlZ5G:zvqSye+ElGdqU7uy5w9WMyCN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3792	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 2672	1432	0fe591834431f52ca459aacfda3bf5c0_NeikiAnalytics.exe	92
PID 1432 wrote to memory of 2672	1432	0fe591834431f52ca459aacfda3bf5c0_NeikiAnalytics.exe	92
PID 1432 wrote to memory of 2672	1432	0fe591834431f52ca459aacfda3bf5c0_NeikiAnalytics.exe	92
PID 2672 wrote to memory of 3792	2672	cmd.exe	93
PID 2672 wrote to memory of 3792	2672	cmd.exe	93
PID 2672 wrote to memory of 3792	2672	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\0fe591834431f52ca459aacfda3bf5c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0fe591834431f52ca459aacfda3bf5c0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:3792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:2412

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 b21855477ed61271d1023619decc000aff7ac6c26067494a9b4e8fd649852e62
MD5 2e0b44f662ca107ad8f1899e38921159
SHA1 f86e81d9be1fa652bc553958bab6b9bdf20de864
SHA512 b794935633ee9eab671602367e1ce1dbd35cb5cb95b62f9e15e9171d6e12783fd19258c5748f4f86a2df6d6b4d17b400f5bb639a13d9f9b24ca10b0ee32a2a63
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5ymB8GMGlZ5G:zv+vTpGdqU7uy5w9WMymN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1432-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3792-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download