c8510a3cda540824948abee30fcf2fc6923ee3864159475d16dc7395a8cd473f

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 13:00

Target

e8264ae87c0eb12551637dee818e4900_NeikiAnalytics.exe
Size

6.0MB
MD5

e8264ae87c0eb12551637dee818e4900
SHA1

f44e76e762a8c44c47204bd4476a2e03e184eeff
SHA256

c8510a3cda540824948abee30fcf2fc6923ee3864159475d16dc7395a8cd473f
SHA512

8cf3a42e9148c50cdeb1e870085c7a004ad0ce0f360d2775464ef36becc482a01acb498c06cb6fe356a85aafa7fd0e08f34a817fdfd70d8af70ff5c09fd80151
SSDEEP

98304:emhd1UryewpoevGeuV7wQqZUha5jtSyZIUS:elQpHv7u2QbaZtlir

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1300	3E8F.tmp

Executes dropped EXE 1 IoCs

pid	Process
1300	3E8F.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 1300	4996	e8264ae87c0eb12551637dee818e4900_NeikiAnalytics.exe	84
PID 4996 wrote to memory of 1300	4996	e8264ae87c0eb12551637dee818e4900_NeikiAnalytics.exe	84
PID 4996 wrote to memory of 1300	4996	e8264ae87c0eb12551637dee818e4900_NeikiAnalytics.exe	84

C:\Users\Admin\AppData\Local\Temp\e8264ae87c0eb12551637dee818e4900_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e8264ae87c0eb12551637dee818e4900_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Users\Admin\AppData\Local\Temp\3E8F.tmp
  "C:\Users\Admin\AppData\Local\Temp\3E8F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\e8264ae87c0eb12551637dee818e4900_NeikiAnalytics.exe 0FA010E187ADF900838D8B7D6478483F301D84F6E6CA011FD7DD6CA26C9ED816B9E5375D841941309758B9B5B0FE6877CE6C5BD5B1C4015A15B4CF46BBE98AD8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1300

C:\Users\Admin\AppData\Local\Temp\3E8F.tmp

Filesize
6.0MB

MD5
2075b071499f728d8ed78f257b049594

SHA1
430c27dac86bf9946c3919eed16585ce2a257b75

SHA256
f1fd223815cbc4b20f52fd33793cf6af817e016ca553db7d8278ec989d03b55b

SHA512
bc5c543707ccb7c1d8deb9d5709b1705a4ec92aed799a4e2e4f314a35ec061e3ad69936edf1c0aa6d9f20f7819f2380c021a552720359d67e1e2b6eb36405738

Download Submit
memory/1300-5-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download
memory/4996-0-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download