c7cdd5fbf603dd073c20caeb4549bfb2f46d25b5a09eb7a6bdca3a8a796aacc7

Analysis

max time kernel
132s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:00

Target

a108cefc19829d1b63ce8c6c4d2e7560_NeikiAnalytics.exe
Size

73KB
MD5

a108cefc19829d1b63ce8c6c4d2e7560
SHA1

27b509efae72e7f353cd1b1cf79b5ac95c1b4e6c
SHA256

c7cdd5fbf603dd073c20caeb4549bfb2f46d25b5a09eb7a6bdca3a8a796aacc7
SHA512

2b876676f27d7b8d5cefc66059684d8e050c058b36b05f95c6c7f59324b2a1fff7d8afa318a1c79e8b9e3c3b956a067abc08a9b273b990a4c77192c137517f40
SSDEEP

1536:hbH1xeUhdK5QPqfhVWbdsmA+RjPFLC+e5hC0ZGUGf2g:hreUhdNPqfcxA+HFshCOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4156	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 5040	2336	a108cefc19829d1b63ce8c6c4d2e7560_NeikiAnalytics.exe	92
PID 2336 wrote to memory of 5040	2336	a108cefc19829d1b63ce8c6c4d2e7560_NeikiAnalytics.exe	92
PID 2336 wrote to memory of 5040	2336	a108cefc19829d1b63ce8c6c4d2e7560_NeikiAnalytics.exe	92
PID 5040 wrote to memory of 4156	5040	cmd.exe	93
PID 5040 wrote to memory of 4156	5040	cmd.exe	93
PID 5040 wrote to memory of 4156	5040	cmd.exe	93
PID 4156 wrote to memory of 2792	4156	[email protected]	94
PID 4156 wrote to memory of 2792	4156	[email protected]	94
PID 4156 wrote to memory of 2792	4156	[email protected]	94

C:\Users\Admin\AppData\Local\Temp\a108cefc19829d1b63ce8c6c4d2e7560_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a108cefc19829d1b63ce8c6c4d2e7560_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4156
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1288,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:8
1⤵
PID:924

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
314b03470e612fc8256111cd39d4fd3b

SHA1
61293fd6594e28abdaf53a1195be23d159bc76ea

SHA256
807bffe1b0c552fe34a7a34fdc53ee51d1b8ae73f424c834c969448e7adfac18

SHA512
8c03a3484003200c2a3543fcfb83c8962160d1c8792d31234cbde9f251f08ef217295099134b2a66842ad618b6cbdd4c1d03166e1ba6709d724bce2fbc1312c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/2336-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4156-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download