f5e6007f884139f3348fa38c29a2ea8b5a83edc40e16db0b325f5e651efb98cb

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 22:22

Target

0f060db83e2d61c424a91aefde239f20_NeikiAnalytics.exe
Size

79KB
MD5

0f060db83e2d61c424a91aefde239f20
SHA1

1d73deb7e51bf93ade0cf8175a5e0e08056c0d69
SHA256

f5e6007f884139f3348fa38c29a2ea8b5a83edc40e16db0b325f5e651efb98cb
SHA512

bc1c6e0371e7fc06ed6c58618bdcb22652d269f57a5563b59c6be22fdfece9a5aab8a315ce9868fea42ba930487de047341f780cfb4eb77cd0faef031aa8a18e
SSDEEP

1536:zvBhcIFGoQftrSOQA8AkqUhMb2nuy5wgIP0CSJ+5ylB8GMGlZ5G:zvqrXGdqU7uy5w9WMylN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4636	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 4592	548	0f060db83e2d61c424a91aefde239f20_NeikiAnalytics.exe	82
PID 548 wrote to memory of 4592	548	0f060db83e2d61c424a91aefde239f20_NeikiAnalytics.exe	82
PID 548 wrote to memory of 4592	548	0f060db83e2d61c424a91aefde239f20_NeikiAnalytics.exe	82
PID 4592 wrote to memory of 4636	4592	cmd.exe	83
PID 4592 wrote to memory of 4636	4592	cmd.exe	83
PID 4592 wrote to memory of 4636	4592	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\0f060db83e2d61c424a91aefde239f20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0f060db83e2d61c424a91aefde239f20_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:4636

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
e09c98d5b22d6bb5e2146bf4d41cc60d

SHA1
4759c7d807182921bb4226f8e8259af0a004618d

SHA256
81c88a967b8c0b26ba5f72d42cb472746ed5671917b699ec8a40206d0b8e3fd4

SHA512
9f2b1236ed69e59765f13bb54b39d1722366f41373a999fc96909502d04ed4bc0ae7ad42a7c28deeab9f3090aac6bde4982e06340f29fefe64a8408a5db46285

Download Submit
memory/548-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4636-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download