addeb9175372a46446ccff6e169913c82ef8a3fc421c93ebb6d53313ea97035a

Analysis

max time kernel
134s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 15:31

Target

1496a43f2316e97fc67ef10cbd317960_NeikiAnalytics.exe
Size

5.4MB
MD5

1496a43f2316e97fc67ef10cbd317960
SHA1

b45c753b2cdbb53e20be7b8c970555933a0cc83e
SHA256

addeb9175372a46446ccff6e169913c82ef8a3fc421c93ebb6d53313ea97035a
SHA512

cc255b245af1f5193db794a95fed77189148a18f57911f7a4325a15dff6424b9f9dbf341f8b47c5363a4c0c27409f82bb336f1a69bf20afa36da824e7316ddb1
SSDEEP

98304:emhd1UryeUz/tcS0P8acOFh/v9cXV7wQqZUha5jtSyZIUh:elISZj51KX2QbaZtliU

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4908	7927.tmp

Executes dropped EXE 1 IoCs

pid	Process
4908	7927.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 4908	4552	1496a43f2316e97fc67ef10cbd317960_NeikiAnalytics.exe	85
PID 4552 wrote to memory of 4908	4552	1496a43f2316e97fc67ef10cbd317960_NeikiAnalytics.exe	85
PID 4552 wrote to memory of 4908	4552	1496a43f2316e97fc67ef10cbd317960_NeikiAnalytics.exe	85

C:\Users\Admin\AppData\Local\Temp\1496a43f2316e97fc67ef10cbd317960_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1496a43f2316e97fc67ef10cbd317960_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Users\Admin\AppData\Local\Temp\7927.tmp
  "C:\Users\Admin\AppData\Local\Temp\7927.tmp" --splashC:\Users\Admin\AppData\Local\Temp\1496a43f2316e97fc67ef10cbd317960_NeikiAnalytics.exe 87334A7C83BC2CF633C7E764B1401D1B5958DD3A6DF3E58E90166C1AACD47CB4F4E468DF0ED6EABC5C328D0D207A917C7CF6F9ED705B3AE58136FBCA4CC7E0CD
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4908

C:\Users\Admin\AppData\Local\Temp\7927.tmp

Filesize
5.4MB

MD5
dbf5f3f3a5b72fe643e6e5f4a2f525af

SHA1
3c99bf8132bd678369f12fc48a624497a4f81d78

SHA256
97a7509dce875a77b9d381355f0ecc4e8537fa8bb229ec6b8a0c25667386bdb1

SHA512
ab33aae89d1208c9cc46aede07c5730ea3a8661676b28e1a19b7bdaddbc8f74181dc76bd178cb870d1c9c2268758995029cb770bf68c78b6a8f095d4846ae0d1

Download Submit
memory/4552-0-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download
memory/4908-5-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download