5f97d2bb2d2de7f2ce8aa87caeca236d334f9444832254bc49f2369c2d6a5770

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 08:51

Target

adc7571a07c86510cd0412dcefa08ca0_NeikiAnalytics.exe
Size

79KB
MD5

adc7571a07c86510cd0412dcefa08ca0
SHA1

d373b8a312f41779e2766f33d48a258af188ac80
SHA256

5f97d2bb2d2de7f2ce8aa87caeca236d334f9444832254bc49f2369c2d6a5770
SHA512

4637f12ee91e7e12ce0453dfab3d14aa04e1d1c2498170e5c84e71d525e4122dc200b316ba5eac094b05cd7257bbad76c8a0c631ef9a5948b2cdbb7dd4ef7ee6
SSDEEP

1536:zv29QwwwNzzzzfDFYVRHyOQA8AkqUhMb2nuy5wgIP0CSJ+5ykB8GMGlZ5G:zv2OwwwFDFOXGdqU7uy5w9WMykN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
692	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 4600	1212	adc7571a07c86510cd0412dcefa08ca0_NeikiAnalytics.exe	83
PID 1212 wrote to memory of 4600	1212	adc7571a07c86510cd0412dcefa08ca0_NeikiAnalytics.exe	83
PID 1212 wrote to memory of 4600	1212	adc7571a07c86510cd0412dcefa08ca0_NeikiAnalytics.exe	83
PID 4600 wrote to memory of 692	4600	cmd.exe	84
PID 4600 wrote to memory of 692	4600	cmd.exe	84
PID 4600 wrote to memory of 692	4600	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\adc7571a07c86510cd0412dcefa08ca0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\adc7571a07c86510cd0412dcefa08ca0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:692

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
6e94f1f41e590ee0791f377413fc00d8

SHA1
e6602d6ee8ee27df6e74b06be73ae6fae820d879

SHA256
8a1cb60c63297d4e06a703b960df343fe106f10f3039da7d38070e1ec1fcc44f

SHA512
24d2997528af1beb78cad92d27e87806a39302eb00c0f7acc6c5770bf855048ed0e1b00187c5c7a625e550bebf82176cd2416c6cab14af6d91f0b56ae50c97e3

Download Submit
memory/692-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1212-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download