6895a6e9e8c314b03a1db7c19f03f4816992a614313869b4079f33d6915e02d5

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 17:18

Target

2e56f103fa417d2f8069b203c951b8d0_NeikiAnalytics.exe
Size

73KB
MD5

2e56f103fa417d2f8069b203c951b8d0
SHA1

38591267591c94a0cc05e0413c307e3beee05f5b
SHA256

6895a6e9e8c314b03a1db7c19f03f4816992a614313869b4079f33d6915e02d5
SHA512

42e28a738caa5616c8ad71c36d82be7e3ac4bf7744028d8a066f0fb59e4d58df5c3d4b38477e42b7a821c2dbb3d063b2af739d57c13c5018eeda107d3289f046
SSDEEP

1536:hbZgPaa0RNK5QPqfhVWbdsmA+RjPFLC+e5hr0ZGUGf2g:hNgeRNNPqfcxA+HFshrOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4488	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 808	2972	2e56f103fa417d2f8069b203c951b8d0_NeikiAnalytics.exe	83
PID 2972 wrote to memory of 808	2972	2e56f103fa417d2f8069b203c951b8d0_NeikiAnalytics.exe	83
PID 2972 wrote to memory of 808	2972	2e56f103fa417d2f8069b203c951b8d0_NeikiAnalytics.exe	83
PID 808 wrote to memory of 4488	808	cmd.exe	84
PID 808 wrote to memory of 4488	808	cmd.exe	84
PID 808 wrote to memory of 4488	808	cmd.exe	84
PID 4488 wrote to memory of 3600	4488	[email protected]	85
PID 4488 wrote to memory of 3600	4488	[email protected]	85
PID 4488 wrote to memory of 3600	4488	[email protected]	85

C:\Users\Admin\AppData\Local\Temp\2e56f103fa417d2f8069b203c951b8d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2e56f103fa417d2f8069b203c951b8d0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:3600

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
29dc2c3839ab40d0e022240707d605dc

SHA1
1d8b7dbd5facf4140454886e268211721622cc00

SHA256
6d3b29dd729b890de32c140ce263e44e3a189eabd5a40f42dce73439ad694901

SHA512
2f47a7b952432582b1853f44c8a500a8ae09424c4b7d9acb8c680b776f1869e411414592975870f710942d33846d45ec626428a0c6434fa609cdc947643b4eb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/2972-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4488-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download