09e112f3f7ac44daa0a975267aaba2a47a1990be7a00b5c3f6887ae43f8396c4

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 23:23

Target

2aa9b18ef67baa31197e597f25a88b20_NeikiAnalytics.exe
Size

65KB
MD5

2aa9b18ef67baa31197e597f25a88b20
SHA1

8ec5fa9e77e5e0a98d6ed558733bcecbf0060d25
SHA256

09e112f3f7ac44daa0a975267aaba2a47a1990be7a00b5c3f6887ae43f8396c4
SHA512

d483682e123f5bc49ec6db83d45f27deda0cbf62617702577181a896d9508303415b5677974052fa442fd29b28df27fde0da8c5dec3d8f7b8d16cfbf057c23a3
SSDEEP

768:Glzu/f9Uw/E6zy4n8uZ5tUXMJ+fROUmELY2glEbM3j+rd+fpR0OTW/ReOOW:GaRTzy48untU8fOMEI3jyYfPBYOW

Score

1^/10

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 4856	4024	2aa9b18ef67baa31197e597f25a88b20_NeikiAnalytics.exe	83
PID 4024 wrote to memory of 4856	4024	2aa9b18ef67baa31197e597f25a88b20_NeikiAnalytics.exe	83
PID 4024 wrote to memory of 4856	4024	2aa9b18ef67baa31197e597f25a88b20_NeikiAnalytics.exe	83
PID 4856 wrote to memory of 4952	4856	cmd.exe	85
PID 4856 wrote to memory of 4952	4856	cmd.exe	85
PID 4856 wrote to memory of 4952	4856	cmd.exe	85
PID 4952 wrote to memory of 1192	4952	iexpress.exe	86
PID 4952 wrote to memory of 1192	4952	iexpress.exe	86
PID 4952 wrote to memory of 1192	4952	iexpress.exe	86

C:\Users\Admin\AppData\Local\Temp\2aa9b18ef67baa31197e597f25a88b20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2aa9b18ef67baa31197e597f25a88b20_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\52B4.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\2aa9b18ef67baa31197e597f25a88b20_NeikiAnalytics.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\SysWOW64\iexpress.exe
    iexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Windows\SysWOW64\makecab.exe
      C:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"
      4⤵
      PID:1192

C:\Users\Admin\AppData\Local\Temp\52B4.tmp\1.bat

Filesize
1KB

MD5
02dba5f37067292355c6d01a57d4ef48

SHA1
7c67ab3f99fbf7a53018dd295d2968c525db83d9

SHA256
8b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242

SHA512
12201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a

Download Submit
C:\Users\Admin\AppData\Local\Temp\popup.sed

Filesize
65KB

MD5
0dfd4201042b569395eef680ab613e83

SHA1
548c8aa658de83a7d2c345cd0b14f32e1710d6a2

SHA256
efc5aa92fe3f4dc9355f79f5e10fec60e3ccc0d58976486dff6597326ec03a04

SHA512
1defbcc06111710c243b7dcf89f047f7e63fccd3e7072bc9bac96caa82b20d101e8b04d88c150cb72e917eeb795eeae09f11d8fba9c4c99af42e06cd44ac7027

Download Submit
C:\Users\Admin\AppData\Local\Temp\~%TargetName%.DDF

Filesize
724B

MD5
c3ca008abd6997c4b036a7e8be75cb2c

SHA1
05f7a3527bb04c691b08f040f562582035398829

SHA256
29ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3

SHA512
bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083

Download Submit
memory/4024-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4024-12-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download