012b1f08b7ef25ba72fc148328da88c509b68323347c85dae162216c43f92404

Analysis

max time kernel
94s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 02:59

Target

55c6340080bd51609158eafe9a8d6410_NeikiAnalytics.exe
Size

79KB
MD5

55c6340080bd51609158eafe9a8d6410
SHA1

921c54c41f8b07e75da83bfdded5a0b6af8b51ad
SHA256

012b1f08b7ef25ba72fc148328da88c509b68323347c85dae162216c43f92404
SHA512

cf688959c35dca1294603528dd43a285a0cc08d62bc94c3bc3fb669d4d026c6b881a29dcbc61a54cd26fb5a04a514dbccd6e069a64d6e2460c9b6639a9bd8dea
SSDEEP

1536:zvWVp8E5yc1l8OUhOQA8AkqUhMb2nuy5wgIP0CSJ+5ylB8GMGlZ5G:zvAiLOhGdqU7uy5w9WMylN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
212	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 2648	3276	55c6340080bd51609158eafe9a8d6410_NeikiAnalytics.exe	83
PID 3276 wrote to memory of 2648	3276	55c6340080bd51609158eafe9a8d6410_NeikiAnalytics.exe	83
PID 3276 wrote to memory of 2648	3276	55c6340080bd51609158eafe9a8d6410_NeikiAnalytics.exe	83
PID 2648 wrote to memory of 212	2648	cmd.exe	84
PID 2648 wrote to memory of 212	2648	cmd.exe	84
PID 2648 wrote to memory of 212	2648	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\55c6340080bd51609158eafe9a8d6410_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\55c6340080bd51609158eafe9a8d6410_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:212

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
841b70ab6f60ed11f962bb98ff4bfb0b

SHA1
f04a869eb357ad7ffd7b6fbfb7f7cc3fc167e1b4

SHA256
446ff5d82444b503836539434bfc2f8b858f0af9ecb7660141ee940470c54fb3

SHA512
42e1e73206c51b76a78fd5b6bacbaaffb09c756d5bfa8981ee4ef51d9be08b942a9abca3acd5ba2a0a9c70e47b8ff172553b362ec2eee1c34729fbcf7944433a

Download Submit
memory/212-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3276-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download