8969eda503dbe8eb26a57b24b0cc25bff39035c594b6a653a02fb8a00a1269ef

Analysis

max time kernel
136s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 02:00

Target

4504e015b13cd0353a7194c5439294f0_NeikiAnalytics.exe
Size

73KB
MD5

4504e015b13cd0353a7194c5439294f0
SHA1

c7f803ea5503c0ac32da424f2ec4a9047a536b8b
SHA256

8969eda503dbe8eb26a57b24b0cc25bff39035c594b6a653a02fb8a00a1269ef
SHA512

e89ff6074eda09377b23ef693017b88ee552e14063a6be93b14dc5dac0abf0c84ff272ccb0593c05c5d8c55072ebda40bcae6a7d839b11e2dbdfa07ee35e2412
SSDEEP

1536:hbXzeDY4a/DcK5QPqfhVWbdsmA+RjPFLC+e5h80ZGUGf2g:hDzeDMcNPqfcxA+HFsh8Og

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4380	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 4196	3956	4504e015b13cd0353a7194c5439294f0_NeikiAnalytics.exe	84
PID 3956 wrote to memory of 4196	3956	4504e015b13cd0353a7194c5439294f0_NeikiAnalytics.exe	84
PID 3956 wrote to memory of 4196	3956	4504e015b13cd0353a7194c5439294f0_NeikiAnalytics.exe	84
PID 4196 wrote to memory of 4380	4196	cmd.exe	85
PID 4196 wrote to memory of 4380	4196	cmd.exe	85
PID 4196 wrote to memory of 4380	4196	cmd.exe	85
PID 4380 wrote to memory of 4064	4380	[email protected]	86
PID 4380 wrote to memory of 4064	4380	[email protected]	86
PID 4380 wrote to memory of 4064	4380	[email protected]	86

C:\Users\Admin\AppData\Local\Temp\4504e015b13cd0353a7194c5439294f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4504e015b13cd0353a7194c5439294f0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4380
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:4064

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
84f8c8a61abce78043f46a913e505509

SHA1
5a989cda695454e9afaa6cfebb4c7a298cb4a620

SHA256
748e3d8d89b678d6ad2b1a448888441e761613970b26a12e940fbfdd734a5158

SHA512
539e6b8d5a42e3a9d80a6680eb2f1798eea5f9fb931b36538a1abf0adbe9ec8d8646d04533d4b6147549572fc597f115032308df9a17fee89db461c936d16808

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/3956-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4380-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download