5432e359e7cc4d68f327aec94864c82561692ce8b283b3df005f5d8f590256d3

Analysis

max time kernel
141s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 19:30

Target

1fd1027f4511599c712d02cc01a77d60_NeikiAnalytics.exe
Size

2.9MB
MD5

1fd1027f4511599c712d02cc01a77d60
SHA1

269405d29feb9a8df54d124a5f89d4d03e262530
SHA256

5432e359e7cc4d68f327aec94864c82561692ce8b283b3df005f5d8f590256d3
SHA512

d01f9703c7a89e210176bac6c061ba3d436b884b2bffba55b6eee7d6232f636d70c075fd6b0320f7624b79a9e4489f98db5e2e6e6fb6ebc80d4f445ac8d0b1ab
SSDEEP

49152:vxhJ0eWndt484NyTj3jHzhosdCHkL+SRVtnv+affbdLoNFl3dqLqDLnOI5WsLpb:Zhm94XybqsZ+SR3nmafDdgnNMqDLn5Wg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
428	k.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\kqbx\k.exe	1fd1027f4511599c712d02cc01a77d60_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 428	3084	1fd1027f4511599c712d02cc01a77d60_NeikiAnalytics.exe	83
PID 3084 wrote to memory of 428	3084	1fd1027f4511599c712d02cc01a77d60_NeikiAnalytics.exe	83
PID 3084 wrote to memory of 428	3084	1fd1027f4511599c712d02cc01a77d60_NeikiAnalytics.exe	83

C:\Users\Admin\AppData\Local\Temp\1fd1027f4511599c712d02cc01a77d60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1fd1027f4511599c712d02cc01a77d60_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Program Files (x86)\kqbx\k.exe
  "C:\Program Files (x86)\kqbx\k.exe"
  2⤵
  - Executes dropped EXE
  PID:428

C:\Program Files (x86)\kqbx\k.exe

Filesize
3.0MB

MD5
a5f317e500d1427ddc84be78318716e9

SHA1
953b035b4d6183d21f91b8e8239c45d3f4172428

SHA256
ba3f858ce579e7af8a26e89a607c9f560d11f7973c05bdbc0a760cdefc908201

SHA512
79aee346163b07ceb50f76c421f38821574905efbf339d1a6dc6c1d2fe3f3ee3cb6e6d55b20eb0ff1952909f8550c559e6fcd660cf4308c4272a6b090ee73f71

Download Submit
memory/428-7-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/428-8-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/428-9-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3084-0-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3084-1-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3084-6-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download