22d162e768f143ab0e12256903c1417e6c157c067f0b9f4aca3de04c74193d52

Analysis

max time kernel
132s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 10:57

Target
a0efdd2f1687336b0fe5ca96bda07a60_NeikiAnalytics.exe
Size 79KB
Sample240603-m2a24sdd47
SHA256 22d162e768f143ab0e12256903c1417e6c157c067f0b9f4aca3de04c74193d52
MD5 a0efdd2f1687336b0fe5ca96bda07a60
SHA1 ad912d45b5ad6209a203eca49cd3f1c69a43f053
SHA512 8e5dac71d1c3fde664c2b96cf34bd8b617a13b83eb7c3b9289675ef4f0a85ea20c840af1a17ec0c65b81865289fcec4494f7c1a2aeaa9424c7c5b219592af1d5
SSDEEP 1536:zvOu444kuX3UFPRWqykfOQA8AkqUhMb2nuy5wgIP0CSJ+5y5tB8GMGlZ5G:zvp4449X+pJWGdqU7uy5w9WMyrN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2400	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 3996	2036	a0efdd2f1687336b0fe5ca96bda07a60_NeikiAnalytics.exe	91
PID 2036 wrote to memory of 3996	2036	a0efdd2f1687336b0fe5ca96bda07a60_NeikiAnalytics.exe	91
PID 2036 wrote to memory of 3996	2036	a0efdd2f1687336b0fe5ca96bda07a60_NeikiAnalytics.exe	91
PID 3996 wrote to memory of 2400	3996	cmd.exe	92
PID 3996 wrote to memory of 2400	3996	cmd.exe	92
PID 3996 wrote to memory of 2400	3996	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\a0efdd2f1687336b0fe5ca96bda07a60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a0efdd2f1687336b0fe5ca96bda07a60_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4212,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:8
1⤵
PID:4856

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 bba7b287214cca121f345ef6b80ab7b56d39322756ea7a3c7b8cf6ba7c044cba
MD5 2874ce72c9df8b446fa15ca65d54003b
SHA1 512da7a8ec5ac6ab3eec009d3eadba1b9b2cb918
SHA512 b7aca8fbec1465afe2bc647876487d8dc2eb48cc816779b64c783995bea614b1323146107c97d39632c7107a4d7d0001799b3d6d6a41b5bf96a5b5db73dd185f
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5yBtB8GMGlZ5G:zv+vTpGdqU7uy5w9WMyjN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2036-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2400-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download