444a40b750cc5d5bfbb9e7194e348c58db676d9d580f9fa9f30e3abace9a68ea

Analysis

max time kernel
142s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 08:44

Target

444a40b750cc5d5bfbb9e7194e348c58db676d9d580f9fa9f30e3abace9a68ea_NeikiAnalytics.exe
Size

79KB
MD5

974569d6523199de2745b1a997e4e0e0
SHA1

0654594327b99c26dace2dc0974848ec4e00aa20
SHA256

444a40b750cc5d5bfbb9e7194e348c58db676d9d580f9fa9f30e3abace9a68ea
SHA512

74346cd18384d4a1601e289ea62c9c4204ae5da8a1c9eff7051eb1be7857ab63eb44edac80f55b7fcba7d4fcdf7feae76b527b341dfcc8f869a16ec00ef09c79
SSDEEP

1536:zvuE77Aou+e+OQA8AkqUhMb2nuy5wgIP0CSJ+5yBB8GMGlZ5G:zvuE7c+MGdqU7uy5w9WMyBN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3644	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 3336	740	444a40b750cc5d5bfbb9e7194e348c58db676d9d580f9fa9f30e3abace9a68ea_NeikiAnalytics.exe	94
PID 740 wrote to memory of 3336	740	444a40b750cc5d5bfbb9e7194e348c58db676d9d580f9fa9f30e3abace9a68ea_NeikiAnalytics.exe	94
PID 740 wrote to memory of 3336	740	444a40b750cc5d5bfbb9e7194e348c58db676d9d580f9fa9f30e3abace9a68ea_NeikiAnalytics.exe	94
PID 3336 wrote to memory of 3644	3336	cmd.exe	95
PID 3336 wrote to memory of 3644	3336	cmd.exe	95
PID 3336 wrote to memory of 3644	3336	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\444a40b750cc5d5bfbb9e7194e348c58db676d9d580f9fa9f30e3abace9a68ea_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\444a40b750cc5d5bfbb9e7194e348c58db676d9d580f9fa9f30e3abace9a68ea_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4280,i,6522675234395427298,2952738987384583032,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
1⤵
PID:4240

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
5eaff500475398514c0c2a92f8a511e0

SHA1
e9cf8d66ccb9253d1219b5eb339d158b2d9ea194

SHA256
32d94208144ff1b1a5422d7e68ae8371a5677ddd26e590df06610bad1d0279b8

SHA512
7e138caba4cca64f1688e5ae680383fb75dcc1263c674d210d201fd0be80c3b671f67390e58e0649998ddc2466f0dc7953a17bb26e21ed48bbcca8034e053493

Download Submit
memory/740-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3644-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download