f87fd136e54b8f1b4974959a4e7e7d8171897fcd3e77c9ad8c7aaafb1a5dc34f

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 04:18

Target

6a6f20158d517536da551f000f1e43d0_NeikiAnalytics.exe
Size

73KB
MD5

6a6f20158d517536da551f000f1e43d0
SHA1

8d2b85ae3e03cff1608c69d4eefc992cf84de3c3
SHA256

f87fd136e54b8f1b4974959a4e7e7d8171897fcd3e77c9ad8c7aaafb1a5dc34f
SHA512

b7576c69ac0e404364546cc8fb2336389c3a03b5579752c4ecb716fb6df4b7fbc99f74b3901016cc52abe44d3b5d9853864274a24166f0b6728336dcd0e6c756
SSDEEP

1536:hbS7jwHOIGK5QPqfhVWbdsmA+RjPFLC+e5hhHQ0ZGUGf2g:h4jpVNPqfcxA+HFshhwOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3604	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 4272	2876	6a6f20158d517536da551f000f1e43d0_NeikiAnalytics.exe	84
PID 2876 wrote to memory of 4272	2876	6a6f20158d517536da551f000f1e43d0_NeikiAnalytics.exe	84
PID 2876 wrote to memory of 4272	2876	6a6f20158d517536da551f000f1e43d0_NeikiAnalytics.exe	84
PID 4272 wrote to memory of 3604	4272	cmd.exe	85
PID 4272 wrote to memory of 3604	4272	cmd.exe	85
PID 4272 wrote to memory of 3604	4272	cmd.exe	85
PID 3604 wrote to memory of 1120	3604	[email protected]	86
PID 3604 wrote to memory of 1120	3604	[email protected]	86
PID 3604 wrote to memory of 1120	3604	[email protected]	86

C:\Users\Admin\AppData\Local\Temp\6a6f20158d517536da551f000f1e43d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6a6f20158d517536da551f000f1e43d0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3604
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:1120

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
8e4b4a87432046d5e7a4f4af0ca75b2b

SHA1
88e02ad4320cea87defe8231d824999938c850a8

SHA256
85d677dd14b0ef69c14370c2ad9cb6edf7439c284c44c6b31389a2cc30368f83

SHA512
0184f7ee302114cee72a8ffb213eafa22ea557eb25d45c001a25cb51702068a78de02ffe25eb381969681619d99a9ff3987ee905369741cbc1072de27da613ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/2876-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3604-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download