b8f19bf55d05d263e328d82827180802cbea7b1fa7e189a23066f48c9731fd19

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 07:15

Target

7c6411fc70617c5fb7e820ce38321970_NeikiAnalytics.exe
Size

79KB
MD5

7c6411fc70617c5fb7e820ce38321970
SHA1

709b47410337f0c5d046d37fcbc7f80a194c2df1
SHA256

b8f19bf55d05d263e328d82827180802cbea7b1fa7e189a23066f48c9731fd19
SHA512

75c48ca3b5dfe124ade84e6dbf424ed72ed2214ba7e91983df9381958183fe57085438ed45243cc4ca3d5bd67d0b17757a89cd70389f7b4bb1277634f84ef634
SSDEEP

1536:zvI+hUIvhCXa+buOQA8AkqUhMb2nuy5wgIP0CSJ+5yfB8GMGlZ5G:zvIMUV77GdqU7uy5w9WMyfN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4976	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 4720	4140	7c6411fc70617c5fb7e820ce38321970_NeikiAnalytics.exe	91
PID 4140 wrote to memory of 4720	4140	7c6411fc70617c5fb7e820ce38321970_NeikiAnalytics.exe	91
PID 4140 wrote to memory of 4720	4140	7c6411fc70617c5fb7e820ce38321970_NeikiAnalytics.exe	91
PID 4720 wrote to memory of 4976	4720	cmd.exe	92
PID 4720 wrote to memory of 4976	4720	cmd.exe	92
PID 4720 wrote to memory of 4976	4720	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\7c6411fc70617c5fb7e820ce38321970_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7c6411fc70617c5fb7e820ce38321970_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:1232

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
f04d7fcb9d0a062221b3a30300fe3229

SHA1
cd80358fe26d0b8c5667837a23180ed60857e5c2

SHA256
9b98b24ebe41d314631168309dd29d24d8b7f8be949508dfdddfda26ade50800

SHA512
ba091fa47ac19bd34258ebec4020d26ac1f5796a1e0ea5fde8422cd824c0cc18bafb0a69a7d1bcb3a42d05866a88baaa3c92c8127dc54119441739a8855106d0

Download Submit
memory/4140-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4976-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download