18ebbaecfb3984cefc26e2f7924a9dfe89b69cfe76374b4bea63201b38165a65

Analysis

max time kernel
149s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 11:05

Target

ccb6cf5a0b3b399b56a63513157d8280_NeikiAnalytics.exe
Size

42KB
MD5

ccb6cf5a0b3b399b56a63513157d8280
SHA1

523656919805652fdc907c494360209e8011f044
SHA256

18ebbaecfb3984cefc26e2f7924a9dfe89b69cfe76374b4bea63201b38165a65
SHA512

0c9c3ba885766847d778f0c72b1dc330353dae8395cd4ef5961c57702747070712a97e4c32d2db8c29995c2c3d2709c1460fa17a0d30897277b77fffd73beb6e
SSDEEP

384:cRvJdqOxpqm5LpvmLwtCO/e0Ajj6AH2XWwBOdw65UBsU0BSfcmkNcP4Rio:ghUK3dIgCSJAvLiBOdP2Bd0BccmkTX

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
5004	gjxqk.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 5004	4492	ccb6cf5a0b3b399b56a63513157d8280_NeikiAnalytics.exe	83
PID 4492 wrote to memory of 5004	4492	ccb6cf5a0b3b399b56a63513157d8280_NeikiAnalytics.exe	83
PID 4492 wrote to memory of 5004	4492	ccb6cf5a0b3b399b56a63513157d8280_NeikiAnalytics.exe	83

C:\Users\Admin\AppData\Local\Temp\ccb6cf5a0b3b399b56a63513157d8280_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ccb6cf5a0b3b399b56a63513157d8280_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Users\Admin\AppData\Local\Temp\gjxqk.exe
  C:\Users\Admin\AppData\Local\Temp\gjxqk.exe
  2⤵
  - Executes dropped EXE
  PID:5004

C:\Users\Admin\AppData\Local\Temp\gjxqk.exe

Filesize
42KB

MD5
8a2e451eabdb65340d80fab9cc5d50d4

SHA1
179476a68540fb374b04d6d973dfda4d2aab83c7

SHA256
e83bed5615e625b6b51b98b89c2ad9221a18b8b93033fb40ac15b020dedd596c

SHA512
6f836710feb92e14aab5c5016af0c40d81a079acc1c1da2ec1e67eaba16ce174ae8b1c354a9b9629a6cb08ec6efcdb52771ff71ab538260ad4dc2333c289bbf9

Download Submit
memory/4492-1-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/5004-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download