5018cca1e4040dea39a15efe9ec4d183076a9500f5903d1edf5c6b7922e12c38

Analysis

max time kernel
139s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 21:44

Target

05ea1a045547b1590f3ae863606023e0_NeikiAnalytics.exe
Size

534KB
MD5

05ea1a045547b1590f3ae863606023e0
SHA1

8de6083da38e2e13e50833bb799c693d0499836e
SHA256

5018cca1e4040dea39a15efe9ec4d183076a9500f5903d1edf5c6b7922e12c38
SHA512

73d0469394b0d90825052ca40a594dac0e591360311af78b190ed919408b86c0aa1dfc207c9cfb907d7a48a0a6af7ca9b539ba4013b57deeab1788e5ee8abdb1
SSDEEP

12288:zWBm+95nHfF2mgewFE5reJydqMPS/Q6t1kfgjdkAsSOs:zWBz95ndbgfE5AmPSoVgjTsSOs

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2640	3374.tmp

Executes dropped EXE 1 IoCs

pid	Process
2640	3374.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 2640	3704	05ea1a045547b1590f3ae863606023e0_NeikiAnalytics.exe	82
PID 3704 wrote to memory of 2640	3704	05ea1a045547b1590f3ae863606023e0_NeikiAnalytics.exe	82
PID 3704 wrote to memory of 2640	3704	05ea1a045547b1590f3ae863606023e0_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\05ea1a045547b1590f3ae863606023e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\05ea1a045547b1590f3ae863606023e0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Users\Admin\AppData\Local\Temp\3374.tmp
  "C:\Users\Admin\AppData\Local\Temp\3374.tmp" --pingC:\Users\Admin\AppData\Local\Temp\05ea1a045547b1590f3ae863606023e0_NeikiAnalytics.exe 6A3461DB4717DA46B2A7593F3A4A1ED0F54E12C9646C2345FF310BAD46C446DA36C155C0342A29D1916EA8828BAF2820D9AD78AE651C32A659170A5A6B68D645
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2640

C:\Users\Admin\AppData\Local\Temp\3374.tmp

Filesize
534KB

MD5
35ccedbb8114da8551cf0707d524d36e

SHA1
613bafaa73da300e6c82e48717163c8555bede40

SHA256
5c651fbdd66bc7f8cd2335dc90413ab975aacca60b9232f95435b6385ca7b7b4

SHA512
3a090641bdeeb4a5d6e3ea87b4fed4401492dfdfcfb709b01d4e6969f4fff66feba3a5442e4dd5f346c6abcf012f35d292aac1ab82cc7e7f07ce9f5d1d43eb56

Download Submit
memory/2640-4-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/2640-7-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/3704-0-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download
memory/3704-5-0x0000000000400000-0x000000000048F000-memory.dmp

Filesize
572KB

Download