4ec3bed97688382055f437c654a8b10798bf939ae40acfad0268b5c28ca7cc5d

Analysis

max time kernel
92s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 10:25

Target

c3504397911f12e55e1cf4f0f43e5400_NeikiAnalytics.exe
Size

73KB
MD5

c3504397911f12e55e1cf4f0f43e5400
SHA1

b99277d8270bcdc15f6749fb7638d6815b0423f0
SHA256

4ec3bed97688382055f437c654a8b10798bf939ae40acfad0268b5c28ca7cc5d
SHA512

67746e28831654f8dde0c04d06c97217cf519c58a895b9bb9a6d36f714ee352b79518e963b9f54421fae3a2042cbccfaeafdb4f83b588a3133f5282ce2ad5d9d
SSDEEP

1536:hbErc4dz9P5K5QPqfhVWbdsmA+RjPFLC+e5hU0ZGUGf2g:h74zRNPqfcxA+HFshUOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1324	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 3464	1800	c3504397911f12e55e1cf4f0f43e5400_NeikiAnalytics.exe	83
PID 1800 wrote to memory of 3464	1800	c3504397911f12e55e1cf4f0f43e5400_NeikiAnalytics.exe	83
PID 1800 wrote to memory of 3464	1800	c3504397911f12e55e1cf4f0f43e5400_NeikiAnalytics.exe	83
PID 3464 wrote to memory of 1324	3464	cmd.exe	84
PID 3464 wrote to memory of 1324	3464	cmd.exe	84
PID 3464 wrote to memory of 1324	3464	cmd.exe	84
PID 1324 wrote to memory of 4084	1324	[email protected]	85
PID 1324 wrote to memory of 4084	1324	[email protected]	85
PID 1324 wrote to memory of 4084	1324	[email protected]	85

C:\Users\Admin\AppData\Local\Temp\c3504397911f12e55e1cf4f0f43e5400_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c3504397911f12e55e1cf4f0f43e5400_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1324
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:4084

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
f3ac3643e01263ec43953cb101668525

SHA1
a6f2f0d67f7c9a96c790a39c5c249546e84ace80

SHA256
cf194686dc62950b896138f4c9cf8a60c137d1deeb8851fc4745c3a2f080af25

SHA512
0e58d2cfbf7e4ef034411dc25ce3808f370025905a3ce7f9d3414804b0795b7b696dd8698579c7b1a2bcfe8ccfa9a9751516485f6edf7081298667299041b6d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/1324-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1800-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download