1e9dfd5e4c79b07643b636220516c42764a8de6e33385f30af6015d9fe4957cd

Analysis

max time kernel
133s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 21:47

Target

0b490c6d93846a43fc9d757794050bd0_NeikiAnalytics.exe
Size

79KB
MD5

0b490c6d93846a43fc9d757794050bd0
SHA1

065214fc120381e761ae5e73cbb8e909acc94756
SHA256

1e9dfd5e4c79b07643b636220516c42764a8de6e33385f30af6015d9fe4957cd
SHA512

68ff662c31deefa47e99c329480a6d22a7d9d1154c8ff22d88e68bbefa9df9c4ade7cac30353789b5352f53c920f4db8861b0df3166d2dad940dbb42763d2c6c
SSDEEP

1536:zvdpDHWjMdEtZeZv9OQA8AkqUhMb2nuy5wgIP0CSJ+5ySB8GMGlZ5G:zvdpCIcmvkGdqU7uy5w9WMySN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1048	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 244 wrote to memory of 4088	244	0b490c6d93846a43fc9d757794050bd0_NeikiAnalytics.exe	91
PID 244 wrote to memory of 4088	244	0b490c6d93846a43fc9d757794050bd0_NeikiAnalytics.exe	91
PID 244 wrote to memory of 4088	244	0b490c6d93846a43fc9d757794050bd0_NeikiAnalytics.exe	91
PID 4088 wrote to memory of 1048	4088	cmd.exe	92
PID 4088 wrote to memory of 1048	4088	cmd.exe	92
PID 4088 wrote to memory of 1048	4088	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\0b490c6d93846a43fc9d757794050bd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0b490c6d93846a43fc9d757794050bd0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:1048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4372,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:8
1⤵
PID:1964

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
27b6b7a866cb1e1785fa460250897dcd

SHA1
f584a4bc13a6375551345adefdd9f916a308948d

SHA256
b7cdc721510a9083760cd30a1ae0e83454b4b303951708e5344ea7392969a4b6

SHA512
42a676ec98314432ed4ea9507a64a44347e7e7764cc48feb5a122dd57e6a6780823329229de1fd37eea138993271ba863df59ce5d23cc3d6e111e7e8a1da872e

Download Submit
memory/244-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1048-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download