7de7b6493945cd6794f47a60b637a56727581526e627cce54e7419c193ead406

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 04:49

Target

77dcd127415ee5cc720438c1a44ebe50_NeikiAnalytics.exe
Size

79KB
MD5

77dcd127415ee5cc720438c1a44ebe50
SHA1

e4375f0f074abee65ff68ed7f906fb7381cf86ec
SHA256

7de7b6493945cd6794f47a60b637a56727581526e627cce54e7419c193ead406
SHA512

eabbc1d69e22a423619dd168213ce4efebf56380547d8e55866babce7b126157441304dc1807aecde3b3e94954873f60a6989dfd4025bacbda1758534adfa36d
SSDEEP

1536:zvxVDuD1AYrOQA8AkqUhMb2nuy5wgIP0CSJ+5y3B8GMGlZ5G:zvPqT6GdqU7uy5w9WMy3N5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4260	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 4104	4292	77dcd127415ee5cc720438c1a44ebe50_NeikiAnalytics.exe	93
PID 4292 wrote to memory of 4104	4292	77dcd127415ee5cc720438c1a44ebe50_NeikiAnalytics.exe	93
PID 4292 wrote to memory of 4104	4292	77dcd127415ee5cc720438c1a44ebe50_NeikiAnalytics.exe	93
PID 4104 wrote to memory of 4260	4104	cmd.exe	94
PID 4104 wrote to memory of 4260	4104	cmd.exe	94
PID 4104 wrote to memory of 4260	4104	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\77dcd127415ee5cc720438c1a44ebe50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\77dcd127415ee5cc720438c1a44ebe50_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:4260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3460 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:1560

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
e1827e92c850d7138027a9d49bf71add

SHA1
bf46da5c549604d67da96edc019494d133797d17

SHA256
0058256fa12baded3992008749ac3be6c21c227f50564d03bb2c725921885cd5

SHA512
8fa170b84c384281b4f186b18b0e7347d215e458ba9a81cad550a9701827827832cc40e94c55238b77951451079b80f90a208ce29ef90a766bef20bfaf4cc800

Download Submit
memory/4260-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4292-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download