3743d2203bf1aff49eadb9e4d243f7f1dfb7afd2d10e67a519235f6c5e5e3f30

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 14:10

Target

e17a635e7ea288bbb3e55c8554f59e10_NeikiAnalytics.exe
Size

6.0MB
MD5

e17a635e7ea288bbb3e55c8554f59e10
SHA1

0184653e521aaf3a32c09fc2f8907480dc5e7e8d
SHA256

3743d2203bf1aff49eadb9e4d243f7f1dfb7afd2d10e67a519235f6c5e5e3f30
SHA512

415f436bdf20046702276d3f8e6c33fe3d5c89f0f57c694c7f835bc1c7b11e41964fed7e37c54beb860f3fc805963e1b68059eae6432c99409af46145c84ceb3
SSDEEP

98304:emhd1UryeuuYaBdnTV4g1uV7wQqZUha5jtSyZIUS:elomdneg1u2QbaZtlir

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3988	39DC.tmp

Executes dropped EXE 1 IoCs

pid	Process
3988	39DC.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 3988	1480	e17a635e7ea288bbb3e55c8554f59e10_NeikiAnalytics.exe	82
PID 1480 wrote to memory of 3988	1480	e17a635e7ea288bbb3e55c8554f59e10_NeikiAnalytics.exe	82
PID 1480 wrote to memory of 3988	1480	e17a635e7ea288bbb3e55c8554f59e10_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\e17a635e7ea288bbb3e55c8554f59e10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e17a635e7ea288bbb3e55c8554f59e10_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Users\Admin\AppData\Local\Temp\39DC.tmp
  "C:\Users\Admin\AppData\Local\Temp\39DC.tmp" --splashC:\Users\Admin\AppData\Local\Temp\e17a635e7ea288bbb3e55c8554f59e10_NeikiAnalytics.exe 7E1B15FB3E41DE1B90AA2C05A7F18DC782DB792FF4C9B64A792F9C571134BCE7CFC751774819E9C578EFA5D3741FF5D8F5145B6143625861E7C1F6730C710530
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3988

C:\Users\Admin\AppData\Local\Temp\39DC.tmp

Filesize
6.0MB

MD5
1baac04291809287b0aa10c381db0190

SHA1
a6fe87ae92e64068f71d59945b3d0c0df879074b

SHA256
48ec8133a4501c1e25747f3f51270bd0c081868bf09caffc1c3947adf85c0d4d

SHA512
03d473c9b5a7c04a62b8bb142806615fb593b250ab01bbece9afd0655f30a53f5147758a6b54c2156d1c6dac4c050a5f7d817ef3f479f3fbaaf6e19552460aa6

Download Submit
memory/1480-0-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download
memory/3988-5-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download