5608d51e5ee881c0311d8b0ff92b57fbf1075c51facc0207f4bfdbf9fd40eb53

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 02:33

Target

4eb23aa6ecf414570dfdda2d94430350_NeikiAnalytics.exe
Size

79KB
MD5

4eb23aa6ecf414570dfdda2d94430350
SHA1

cd6b360eb1b4720e11e02811845739529e91a28f
SHA256

5608d51e5ee881c0311d8b0ff92b57fbf1075c51facc0207f4bfdbf9fd40eb53
SHA512

d7fdc41eb73cc4e4dd9c46c3f35afc2e0221e39031741e97016ba0e08d7613f6d4513af157ab683839f97032d065a76400f3ab80f1583239867d7fb794cebddf
SSDEEP

1536:zv/kDzjjSOQA8AkqUhMb2nuy5wgIP0CSJ+5ypBB8GMGlZ5G:zvsbGdqU7uy5w9WMyPN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3260	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 1560	4744	4eb23aa6ecf414570dfdda2d94430350_NeikiAnalytics.exe	87
PID 4744 wrote to memory of 1560	4744	4eb23aa6ecf414570dfdda2d94430350_NeikiAnalytics.exe	87
PID 4744 wrote to memory of 1560	4744	4eb23aa6ecf414570dfdda2d94430350_NeikiAnalytics.exe	87
PID 1560 wrote to memory of 3260	1560	cmd.exe	88
PID 1560 wrote to memory of 3260	1560	cmd.exe	88
PID 1560 wrote to memory of 3260	1560	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\4eb23aa6ecf414570dfdda2d94430350_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4eb23aa6ecf414570dfdda2d94430350_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:3260

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
0e9f38adadb82a496030f821b789dac1

SHA1
4fd32326e99db9c571462cf07243f5d58e6f9ccc

SHA256
9469d541719c60c0396031b07e946025d06f553cfa446524a066d580eef9cb62

SHA512
43a6d8ca5b401362d580b73fca254759e2996a9e91243d92ea6e66705135bcfdbe8d18175e3c4804105da9ab068c83ae7a3a5f927d55f0eb6a1d37bc3ce635eb

Download Submit
memory/3260-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4744-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download