f84800b5882476dfd4b5d229c04a65c75b62be275c542c5fbc908788ff4594ba

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 11:04

Target
5270078a49ba189750911c2aa430cc50_NeikiAnalytics.exe
Size 79KB
Sample240529-m6hmradb37
SHA256 f84800b5882476dfd4b5d229c04a65c75b62be275c542c5fbc908788ff4594ba
MD5 5270078a49ba189750911c2aa430cc50
SHA1 bc29ddb59eca6f837bf50313619b25e3d62de34f
SHA512 a29038e1f7e4a9e5112bc562e791e914c2a9a0392ca56c60a8bac859b1171da800d80d31b928ae1aeef109eb9255365d3713215123359a685c472962b13c14d8
SSDEEP 1536:zv5F8+niQuWw7OQA8AkqUhMb2nuy5wgIP0CSJ+5yqB8GMGlZ5G:zvMEuWwqGdqU7uy5w9WMyqN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2248	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 3976	5064	5270078a49ba189750911c2aa430cc50_NeikiAnalytics.exe	92
PID 5064 wrote to memory of 3976	5064	5270078a49ba189750911c2aa430cc50_NeikiAnalytics.exe	92
PID 5064 wrote to memory of 3976	5064	5270078a49ba189750911c2aa430cc50_NeikiAnalytics.exe	92
PID 3976 wrote to memory of 2248	3976	cmd.exe	93
PID 3976 wrote to memory of 2248	3976	cmd.exe	93
PID 3976 wrote to memory of 2248	3976	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\5270078a49ba189750911c2aa430cc50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5270078a49ba189750911c2aa430cc50_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:3872

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 a858036ba89d77bccae8884ab3a43c6c772e537c3f7e1556c78ec454e21257a7
MD5 403d84c82698dcb9fe36c7665fa3a1e1
SHA1 5661fb041ece9190137aa5d5b0d203a845aa1d57
SHA512 a4f46c1bab9ed48acf505e987ff88f1f7a24f0bda392e9da4d25f268dab945c8c45eed967b47dedaafb66c33cfd7ba3b35c4167724e6304a7678928c38079165
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5ycB8GMGlZ5G:zv+vTpGdqU7uy5w9WMycN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2248-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5064-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download