5206f1e9e281104c7bd15f9f383beada4cf43c033b572cfb91f3afa05f0f6c67

Analysis

max time kernel
149s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 10:39

Target

adcb3b88186c8270d18df93af9300350_NeikiAnalytics.exe
Size

36KB
MD5

adcb3b88186c8270d18df93af9300350
SHA1

253523eca1c020cecf636428f7db6a18fe26f2c2
SHA256

5206f1e9e281104c7bd15f9f383beada4cf43c033b572cfb91f3afa05f0f6c67
SHA512

8526e25443a64e0cc67164a88a75c1717ab5b2f51d317834aa5d6e22e6d72bfc741f1a9fb2582a62c829efc270b90c37105e4229205a926994579be46c0ea6cf
SSDEEP

384:cKUDthWY/ANpYL3QVvSwBRcDgYCNXGQaI/I51Ee2m3wJp6R3IYsBl3VRu:SWTNyMhhvcgNWQBG1Ee/Mg6dTu

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4580	bxqyy.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 4580	3108	adcb3b88186c8270d18df93af9300350_NeikiAnalytics.exe	82
PID 3108 wrote to memory of 4580	3108	adcb3b88186c8270d18df93af9300350_NeikiAnalytics.exe	82
PID 3108 wrote to memory of 4580	3108	adcb3b88186c8270d18df93af9300350_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\adcb3b88186c8270d18df93af9300350_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\adcb3b88186c8270d18df93af9300350_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Users\Admin\AppData\Local\Temp\bxqyy.exe
  C:\Users\Admin\AppData\Local\Temp\bxqyy.exe
  2⤵
  - Executes dropped EXE
  PID:4580

C:\Users\Admin\AppData\Local\Temp\bxqyy.exe

Filesize
36KB

MD5
77a998a73dc8fdd675f0455c3eecbad0

SHA1
3f67607430e79bf36d0fa7915c4a49d518c38d9f

SHA256
d8aa4413aa2afa045c7b0f37a9615ff59041a582f796cc42f2ba959e142e8374

SHA512
8b7352be57fef1f67834598ee7175ad3c99497ffc66fcb826e7ec4c4f148bf65689aafe5a65329649cb2f698e81591fa1b7687e3ba4d93aef04ed1c52d5777e9

Download Submit
memory/3108-4-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/4580-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download