9cff5c842b842f39df02a95a923b5e5bd289b5cd26e6967a737785a16bc388e2

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 03:09

Target

86a0aa512469733a5b8765a27fb6ac40_NeikiAnalytics.exe
Size

5.4MB
MD5

86a0aa512469733a5b8765a27fb6ac40
SHA1

963a54d5318c7451789841e543e787148bac27d8
SHA256

9cff5c842b842f39df02a95a923b5e5bd289b5cd26e6967a737785a16bc388e2
SHA512

fc9f4e00145bb1ab4672b5d951d34571c2e59711ce66c65a7b5cfc4255a320c54d95a8437c17966b06b01f183a071f1cacd0cf803153193e7ddf11fda8dffcdf
SSDEEP

98304:emhd1UryeuPu04m/A47EzkfohAcV7wQqZUha5jtSyZIUh:elOPu04QA4AAfUAc2QbaZtliU

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2180	D0B.tmp

Executes dropped EXE 1 IoCs

pid	Process
2180	D0B.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2180	2332	86a0aa512469733a5b8765a27fb6ac40_NeikiAnalytics.exe	92
PID 2332 wrote to memory of 2180	2332	86a0aa512469733a5b8765a27fb6ac40_NeikiAnalytics.exe	92
PID 2332 wrote to memory of 2180	2332	86a0aa512469733a5b8765a27fb6ac40_NeikiAnalytics.exe	92

C:\Users\Admin\AppData\Local\Temp\86a0aa512469733a5b8765a27fb6ac40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\86a0aa512469733a5b8765a27fb6ac40_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\AppData\Local\Temp\D0B.tmp
  "C:\Users\Admin\AppData\Local\Temp\D0B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\86a0aa512469733a5b8765a27fb6ac40_NeikiAnalytics.exe C0B3E40458CBA144341D24F909915D63803021751A95EA4CEC45867191EF58776F69758E0C22D903DB5D6E9101816EF68009FF27A6FBE26E02FACF244314DBD5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:792

C:\Users\Admin\AppData\Local\Temp\D0B.tmp

Filesize
5.4MB

MD5
9e4295c7e84b35d9ab16067e11407398

SHA1
8a0f83fc681bce643473e5e86750f99c21bc34a3

SHA256
e18c187eb17e5f202e5bd97aa62f4ef2973d74eba30d51aa4b973740542a6072

SHA512
2b570bd957d901134c65b31675e1c4ff9ecac56aff2b97dfcada1e441384bda283587929c097268bf08459436b61bcc7e725b3672aa6af3ac268ceb94fc40054

Download Submit
memory/2180-5-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download
memory/2332-0-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download