054320298dbb7eb4e9ec4b61a8fb212b9aa2eb0dfdc6835b2617adeb525eadcd

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 08:14

Target

ac3266d8119c20d4d6292e9c6486df10_NeikiAnalytics.exe
Size

73KB
MD5

ac3266d8119c20d4d6292e9c6486df10
SHA1

e9268600b97e732297439f45afe52d9b998710f0
SHA256

054320298dbb7eb4e9ec4b61a8fb212b9aa2eb0dfdc6835b2617adeb525eadcd
SHA512

61967b0381c9dd570177a8463848fee09194df17e07a4cc40a94a5af61b0c4e3f45839b843f675a5370e7a00b5f18e5d439eb5bcaebe1e9b9a532d80d46d6dc9
SSDEEP

1536:hbDm76iJasjK5QPqfhVWbdsmA+RjPFLC+e5hG0ZGUGf2g:hW76OLNPqfcxA+HFshGOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
228	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 208	5068	ac3266d8119c20d4d6292e9c6486df10_NeikiAnalytics.exe	83
PID 5068 wrote to memory of 208	5068	ac3266d8119c20d4d6292e9c6486df10_NeikiAnalytics.exe	83
PID 5068 wrote to memory of 208	5068	ac3266d8119c20d4d6292e9c6486df10_NeikiAnalytics.exe	83
PID 208 wrote to memory of 228	208	cmd.exe	85
PID 208 wrote to memory of 228	208	cmd.exe	85
PID 208 wrote to memory of 228	208	cmd.exe	85
PID 228 wrote to memory of 2804	228	[email protected]	86
PID 228 wrote to memory of 2804	228	[email protected]	86
PID 228 wrote to memory of 2804	228	[email protected]	86

C:\Users\Admin\AppData\Local\Temp\ac3266d8119c20d4d6292e9c6486df10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ac3266d8119c20d4d6292e9c6486df10_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:208
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:228
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2804

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
5eeaf9bfb8dd1b5a557dd25972a30653

SHA1
1adc448ccfeae911b454f67dfb2bf9c953f16030

SHA256
19caaf596607f563ffd45ad983512a4df2e922d908523588ee26c7e23cbc9539

SHA512
07d639a392a9e5fc201fe107f7f94b4b929999ac7140758d987291dd2c80cfde503066406e75c998d434fe2f244706e28288cf0deb8dce673882f17c96d41312

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/228-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5068-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download