f5cd7aec750175c714804910117d0ca80d49b9436fe0fdaedbf1760f232a81ea

Analysis

max time kernel
140s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 15:06

Target

6bd29523d22c351160fbb3f04c655380_NeikiAnalytics.exe
Size

73KB
MD5

6bd29523d22c351160fbb3f04c655380
SHA1

89a8d2b7185db43ba79b800c62ffe2eadf3dbf01
SHA256

f5cd7aec750175c714804910117d0ca80d49b9436fe0fdaedbf1760f232a81ea
SHA512

67e1e80249ad61830d0518cba0ac30e0a09a85884bb0c169ae4279ad2baf7dfc16300c4a04d27986371ce0f5b1cc1fc15dfe67e55022d83308e7d3af52df56dc
SSDEEP

1536:hbpO3Cca5eCbzK5QPqfhVWbdsmA+RjPFLC+e5h5d0ZGUGf2g:hVOSD5zzNPqfcxA+HFsh5dOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
988	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 5016	3864	6bd29523d22c351160fbb3f04c655380_NeikiAnalytics.exe	83
PID 3864 wrote to memory of 5016	3864	6bd29523d22c351160fbb3f04c655380_NeikiAnalytics.exe	83
PID 3864 wrote to memory of 5016	3864	6bd29523d22c351160fbb3f04c655380_NeikiAnalytics.exe	83
PID 5016 wrote to memory of 988	5016	cmd.exe	84
PID 5016 wrote to memory of 988	5016	cmd.exe	84
PID 5016 wrote to memory of 988	5016	cmd.exe	84
PID 988 wrote to memory of 1660	988	[email protected]	85
PID 988 wrote to memory of 1660	988	[email protected]	85
PID 988 wrote to memory of 1660	988	[email protected]	85

C:\Users\Admin\AppData\Local\Temp\6bd29523d22c351160fbb3f04c655380_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6bd29523d22c351160fbb3f04c655380_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:988
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:1660

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
8812a1769758d4d74353bccdcc3d2051

SHA1
07100176db79168d9bb0d18fa0666fcb472364ba

SHA256
dd19dbb9ecfc3daf85200ba11ca9857c61c7b0d1496479e99f0dcfce63c26d83

SHA512
62992fe8f20b6e96b609d17f5983ae9f0cf3b9dcfc3cf7852f2947236c592dd54a12109d692c5fcd43498a946cd4e6f03fa83688a3f158d8dc2d998abbfb571b

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/988-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3864-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download