f5f2c27607717158820c30edadc1e9544783c8a28d5142adee5597330a0cbb2d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 23:59

Target

260336131033973e8ceb5ce3de4783b0_NeikiAnalytics.exe
Size

73KB
MD5

260336131033973e8ceb5ce3de4783b0
SHA1

8a7fc9ddfb915008a9cb6308d0d4cfc3034b55a9
SHA256

f5f2c27607717158820c30edadc1e9544783c8a28d5142adee5597330a0cbb2d
SHA512

d1191f8c7feeaa6b5eb00ebb43700f3126ba24c0601b28d9b3598fc7b6cced8493c4e458d60bd90510baf9d65196d9bfeb0356ab18d59bd1efab59b3505536ec
SSDEEP

1536:hb36BZ4v8ZK5QPqfhVWbdsmA+RjPFLC+e5hP0ZGUGf2g:h7GZO8ZNPqfcxA+HFshPOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4684	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 384	1612	260336131033973e8ceb5ce3de4783b0_NeikiAnalytics.exe	83
PID 1612 wrote to memory of 384	1612	260336131033973e8ceb5ce3de4783b0_NeikiAnalytics.exe	83
PID 1612 wrote to memory of 384	1612	260336131033973e8ceb5ce3de4783b0_NeikiAnalytics.exe	83
PID 384 wrote to memory of 4684	384	cmd.exe	84
PID 384 wrote to memory of 4684	384	cmd.exe	84
PID 384 wrote to memory of 4684	384	cmd.exe	84
PID 4684 wrote to memory of 3948	4684	[email protected]	85
PID 4684 wrote to memory of 3948	4684	[email protected]	85
PID 4684 wrote to memory of 3948	4684	[email protected]	85

C:\Users\Admin\AppData\Local\Temp\260336131033973e8ceb5ce3de4783b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\260336131033973e8ceb5ce3de4783b0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:384
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:3948

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
4afea108af0d5980d1a38957275abf5f

SHA1
c8a3821d2f361bd51f35ecee06336dbffeeb3cf5

SHA256
e7d04af784fb84cc1127a1a43df9014d4b428a75c3af0266915b63737c7cf691

SHA512
32611f6ff88bc2dbb422d19ee4471a2ddc501e7d8d7ba26fe0e287b6d00d26ddfe20dc7eff45e54bbf1bae742885bae8217da6e085378645cc91c43ca7f77e89

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/1612-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4684-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download