d52cb0bfabbf529196bff27dd52d72aa94ad37267913301b0e11e7a696d93562

Analysis

max time kernel
142s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 13:42

Target

186565dc305892aa3c1fed8293de2810_NeikiAnalytics.exe
Size

821KB
MD5

186565dc305892aa3c1fed8293de2810
SHA1

3512dbdb9b15efed562fd03e56685be4c4c9ee1b
SHA256

d52cb0bfabbf529196bff27dd52d72aa94ad37267913301b0e11e7a696d93562
SHA512

628647a48892a92aa08bcdf75970eafdf2517c254ddfbbb23d1f435ecac44b843a0c05eee8a02cbce3349b3f08f4ae8ddf39671e5c1ee5f0ada6208b4d9b1922
SSDEEP

12288:UT+W9w7fc1GpbwH29WY2iEQvxg9MeS7pN6OY/KJLZmN1SafY:UTkI1wb8Clv+9J0f6OhLZmN1SafY

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1620	B36.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 1620	4176	186565dc305892aa3c1fed8293de2810_NeikiAnalytics.exe	91
PID 4176 wrote to memory of 1620	4176	186565dc305892aa3c1fed8293de2810_NeikiAnalytics.exe	91
PID 4176 wrote to memory of 1620	4176	186565dc305892aa3c1fed8293de2810_NeikiAnalytics.exe	91

C:\Users\Admin\AppData\Local\Temp\186565dc305892aa3c1fed8293de2810_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\186565dc305892aa3c1fed8293de2810_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Users\Admin\AppData\Local\Temp\B36.tmp
  "C:\Users\Admin\AppData\Local\Temp\B36.tmp"
  2⤵
  - Executes dropped EXE
  PID:1620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:2484

C:\Users\Admin\AppData\Local\Temp\B36.tmp

Filesize
821KB

MD5
dbb3b4ebd924db35dfb74fa26d792a4c

SHA1
0b883a5ee2530388104e2a5a3f9f7d1cdccaeafc

SHA256
7ec149006dbd5c7e9f11d644ee7329a681e1fbb97fceabb4d7c3b7444dd69c63

SHA512
9549a8866a8b81ec92811d83379f23b2e4779b64211db336310cb56352cf7539d4bdeb2cef7fd1b4abaf7fa08a6ed8fa7e913970139cdc3822c15ca7fcc0ee00

Download Submit
memory/1620-4-0x0000000000340000-0x000000000040A000-memory.dmp

Filesize
808KB

Download
memory/1620-7-0x0000000000340000-0x000000000040A000-memory.dmp

Filesize
808KB

Download
memory/4176-0-0x0000000000870000-0x000000000093A000-memory.dmp

Filesize
808KB

Download
memory/4176-6-0x0000000000870000-0x000000000093A000-memory.dmp

Filesize
808KB

Download