07bdecc098be304d0da51db7e959277f76d71f1e39e165f9cab47301dbe92a96

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 04:32

Target

6e68d924653e9f0c315f3dab97f57670_NeikiAnalytics.exe
Size

73KB
MD5

6e68d924653e9f0c315f3dab97f57670
SHA1

928d4a46c3802951f08d5a06159a46750364165d
SHA256

07bdecc098be304d0da51db7e959277f76d71f1e39e165f9cab47301dbe92a96
SHA512

a56712c5e9e5b6532f1625dedf238f1e4002ed9bc49a2a7facf18acaf4f73b0246d759686ee7b21f47ac41b44d1abd3de5d9c2eb390e85615c537ea4ea076fe7
SSDEEP

1536:hbcXhCvalcXK5QPqfhVWbdsmA+RjPFLC+e5hvT0ZGUGf2g:hnNPqfcxA+HFshvTOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
5020	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 5036	4808	6e68d924653e9f0c315f3dab97f57670_NeikiAnalytics.exe	84
PID 4808 wrote to memory of 5036	4808	6e68d924653e9f0c315f3dab97f57670_NeikiAnalytics.exe	84
PID 4808 wrote to memory of 5036	4808	6e68d924653e9f0c315f3dab97f57670_NeikiAnalytics.exe	84
PID 5036 wrote to memory of 5020	5036	cmd.exe	85
PID 5036 wrote to memory of 5020	5036	cmd.exe	85
PID 5036 wrote to memory of 5020	5036	cmd.exe	85
PID 5020 wrote to memory of 3376	5020	[email protected]	86
PID 5020 wrote to memory of 3376	5020	[email protected]	86
PID 5020 wrote to memory of 3376	5020	[email protected]	86

C:\Users\Admin\AppData\Local\Temp\6e68d924653e9f0c315f3dab97f57670_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6e68d924653e9f0c315f3dab97f57670_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:3376

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
665f6e00bc604d6aa1c042b5db8e4003

SHA1
75d0dfaccf66ad42bca7960d9cb1015a2d924a7e

SHA256
0af4c45d81854ba84bed316efbdb5092ea62ba93b85bc8857bd52a14d7e5bfb3

SHA512
aeb60b3a2ad427392b303dd41f98ceb80da05ed610426c3d52ff48d965dfb6a9d20d8b07fc7b22753386d23f5cb22eef0b89937268e739b3f6233af985af395f

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/4808-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5020-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download