d7906b8f3fd33eeaa6ecfbc6eaecadd034184c29c34a06c6b6ec19b257bec399

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 00:13

Target

2067d2af0ed8ff0f87765190849127b0_NeikiAnalytics.exe
Size

68KB
MD5

2067d2af0ed8ff0f87765190849127b0
SHA1

9e702a793a0c0131e9a12fd4072e62fbfcaa7c0f
SHA256

d7906b8f3fd33eeaa6ecfbc6eaecadd034184c29c34a06c6b6ec19b257bec399
SHA512

41b213c1165d2a7238dc95220fc075a7c9af2969ee7d429074055b7b5dd74fa1eb412d4e9ac6801f2d5c55c810aa4b5526d17a9d4ca9c761362f14ba15010b3d
SSDEEP

768:GlCro/f9Uw/E6zy4n8uZ5tUXMJ+fROUmELY2glEbM3j+rd+fpR0OTW/ReOOOX:GPRTzy48untU8fOMEI3jyYfPBYOOX

Score

1^/10

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2520	1912	2067d2af0ed8ff0f87765190849127b0_NeikiAnalytics.exe	90
PID 1912 wrote to memory of 2520	1912	2067d2af0ed8ff0f87765190849127b0_NeikiAnalytics.exe	90
PID 1912 wrote to memory of 2520	1912	2067d2af0ed8ff0f87765190849127b0_NeikiAnalytics.exe	90
PID 2520 wrote to memory of 1244	2520	cmd.exe	91
PID 2520 wrote to memory of 1244	2520	cmd.exe	91
PID 2520 wrote to memory of 1244	2520	cmd.exe	91
PID 1244 wrote to memory of 4608	1244	iexpress.exe	92
PID 1244 wrote to memory of 4608	1244	iexpress.exe	92
PID 1244 wrote to memory of 4608	1244	iexpress.exe	92

C:\Users\Admin\AppData\Local\Temp\2067d2af0ed8ff0f87765190849127b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2067d2af0ed8ff0f87765190849127b0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1C0.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\2067d2af0ed8ff0f87765190849127b0_NeikiAnalytics.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\SysWOW64\iexpress.exe
    iexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1244
  - - C:\Windows\SysWOW64\makecab.exe
      C:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"
      4⤵
      PID:4608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4084,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
1⤵
PID:804

C:\Users\Admin\AppData\Local\Temp\1C0.tmp\1.bat

Filesize
1KB

MD5
02dba5f37067292355c6d01a57d4ef48

SHA1
7c67ab3f99fbf7a53018dd295d2968c525db83d9

SHA256
8b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242

SHA512
12201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a

Download Submit
C:\Users\Admin\AppData\Local\Temp\popup.sed

Filesize
68KB

MD5
70ac508ee4d713c63cd00b390eca467b

SHA1
da3167adb534bc7a2e7ef76b21639d717e9e44eb

SHA256
c443d196584c49206cf19b16925a1cdf580f422750d1554895980f15808905e4

SHA512
58a4e5454e78b4f2b20d0200d7973843319f10aab52d077694227ad29a18801097c162194b0a87ea0039888058ff31a77bc59cf23f07ac7537d16e6a518c1d67

Download Submit
C:\Users\Admin\AppData\Local\Temp\~%TargetName%.DDF

Filesize
724B

MD5
c3ca008abd6997c4b036a7e8be75cb2c

SHA1
05f7a3527bb04c691b08f040f562582035398829

SHA256
29ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3

SHA512
bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083

Download Submit
memory/1912-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1912-12-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download