224f2175042a7b5d82543c8c14dcf07c1b7818332902cedc5d4507d03566fda1

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 01:15

Target

224f2175042a7b5d82543c8c14dcf07c1b7818332902cedc5d4507d03566fda1_NeikiAnalytics.exe
Size

73KB
MD5

6729c54fef7f9a7d3b1e13a8ae573050
SHA1

c2b8b9e2a6a3e4a0c33a1abfbe1ceed76ab90125
SHA256

224f2175042a7b5d82543c8c14dcf07c1b7818332902cedc5d4507d03566fda1
SHA512

54a3d733168bc26af5a5f31c0338e63bb89f02f9bf6c56790caf32f16cc8683eff7931272518243cab82852b7cbd648b2261c05f32062bda04f993c85075ca22
SSDEEP

1536:hbSYv9ZK5QPqfhVWbdsmA+RjPFLC+e5hH0ZGUGf2g:hGYvHNPqfcxA+HFshHOg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 3092	4992	224f2175042a7b5d82543c8c14dcf07c1b7818332902cedc5d4507d03566fda1_NeikiAnalytics.exe	91
PID 4992 wrote to memory of 3092	4992	224f2175042a7b5d82543c8c14dcf07c1b7818332902cedc5d4507d03566fda1_NeikiAnalytics.exe	91
PID 4992 wrote to memory of 3092	4992	224f2175042a7b5d82543c8c14dcf07c1b7818332902cedc5d4507d03566fda1_NeikiAnalytics.exe	91

C:\Users\Admin\AppData\Local\Temp\224f2175042a7b5d82543c8c14dcf07c1b7818332902cedc5d4507d03566fda1_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\224f2175042a7b5d82543c8c14dcf07c1b7818332902cedc5d4507d03566fda1_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 31961.exe
  2⤵
  PID:3092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3992 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:4684

C:\Users\Admin\AppData\Local\Temp\31961.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/4992-3-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download