f09c75cc45754ca7cd62882bef61cfd4cf93b0991cf35df2b720e6127e60a424

Analysis

max time kernel
93s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 14:52

Target

067af59488614698e5c1ea740b9c4e90_NeikiAnalytics.exe
Size

79KB
MD5

067af59488614698e5c1ea740b9c4e90
SHA1

da6266bf34f9d7425337a88cb67b17814ff187ed
SHA256

f09c75cc45754ca7cd62882bef61cfd4cf93b0991cf35df2b720e6127e60a424
SHA512

5a55cea36d9355069cef570574883e2e397d2f9e35bab3aebd632df351478310e54943027e602abca60e7ed141a04bbe4532478ec31b64b6b9d34806af029695
SSDEEP

1536:zvkUugKOznTotoDadOQA8AkqUhMb2nuy5wgIP0CSJ+5yvB8GMGlZ5G:zvJuVtfEGdqU7uy5w9WMyvN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
832	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 1408	3964	067af59488614698e5c1ea740b9c4e90_NeikiAnalytics.exe	83
PID 3964 wrote to memory of 1408	3964	067af59488614698e5c1ea740b9c4e90_NeikiAnalytics.exe	83
PID 3964 wrote to memory of 1408	3964	067af59488614698e5c1ea740b9c4e90_NeikiAnalytics.exe	83
PID 1408 wrote to memory of 832	1408	cmd.exe	85
PID 1408 wrote to memory of 832	1408	cmd.exe	85
PID 1408 wrote to memory of 832	1408	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\067af59488614698e5c1ea740b9c4e90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\067af59488614698e5c1ea740b9c4e90_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:832

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
6740951b4b73669ddd56dc388a5ebe12

SHA1
fcd592de0ae2e61804a87b8be844655f0fb40bc0

SHA256
d8e6368422ce988c577a20e34f8bdb6b4f786b7ca51fca5fec074f09d7c56517

SHA512
c9b18305de88ee7dfd61030c5921ea278e5e8faff8770a8636ea79c98f169995531bf8f8c8bfd693012539b870b1af6dea73fb6a64d5ea2ce29870e144d5bbc2

Download Submit
memory/832-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3964-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download