e74760010823be0c01984920018c7c129fbdd65dba1a5e759b5d4508d460ff7a

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 03:39

Target

602a25f5ea1142d00e0d0e1be5a17c30_NeikiAnalytics.exe
Size

73KB
MD5

602a25f5ea1142d00e0d0e1be5a17c30
SHA1

55f003c71c5c6b0b8da2af526e95de8aaf16f527
SHA256

e74760010823be0c01984920018c7c129fbdd65dba1a5e759b5d4508d460ff7a
SHA512

6b57de5f5425b65fc70c2cb3684b79b0dafdae103fbb08807f85e660a899226c9d05509efabe7c61609f1f3d59a624a81f7d7fa1dffb71058cf1297992cdecb4
SSDEEP

1536:hbmlnULv4K5QPqfhVWbdsmA+RjPFLC+e5hR0ZGUGf2g:hyNPqfcxA+HFshROg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1124	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 916	4444	602a25f5ea1142d00e0d0e1be5a17c30_NeikiAnalytics.exe	83
PID 4444 wrote to memory of 916	4444	602a25f5ea1142d00e0d0e1be5a17c30_NeikiAnalytics.exe	83
PID 4444 wrote to memory of 916	4444	602a25f5ea1142d00e0d0e1be5a17c30_NeikiAnalytics.exe	83
PID 916 wrote to memory of 1124	916	cmd.exe	85
PID 916 wrote to memory of 1124	916	cmd.exe	85
PID 916 wrote to memory of 1124	916	cmd.exe	85
PID 1124 wrote to memory of 4832	1124	[email protected]	86
PID 1124 wrote to memory of 4832	1124	[email protected]	86
PID 1124 wrote to memory of 4832	1124	[email protected]	86

C:\Users\Admin\AppData\Local\Temp\602a25f5ea1142d00e0d0e1be5a17c30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\602a25f5ea1142d00e0d0e1be5a17c30_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1124
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:4832

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
0a41a4626e89ccbb703d0a7e47e15769

SHA1
6132502ab4a1a9a77dc569e7fb5fbe977c187dba

SHA256
c500457c7d1e49bd3c9de09ffd72a9f29e0b76a85983bb076353b9af8ad8002a

SHA512
e7709399160ad5247ff77cb420b46ce5f281e36cd7cac289c4610dda85e1fd7f714daa9bafa7f01ba02bf723cc3771823a205decbb895a834a87954561b6f37a

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/1124-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4444-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download