1110aa48930bbe5c554db24aef41373a615a11f594aec785a5c087cdc4a3c656

Analysis

max time kernel
139s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 00:05

Target

60459877f1db91d5fdc7c8c418daba80_NeikiAnalytics.exe
Size

79KB
MD5

60459877f1db91d5fdc7c8c418daba80
SHA1

1d3f840f5ae1f7bd9d434f1ada71b20c1eab2e8e
SHA256

1110aa48930bbe5c554db24aef41373a615a11f594aec785a5c087cdc4a3c656
SHA512

790b378019cf9c46382cfc6d69391a16ccb36d8150ea2112b2701f4a416a50ad5a8e28d841aef35c38246772a18155972bc8545f77f282451c3a490a6c3bc272
SSDEEP

1536:zvqdANke+cTyY27OQA8AkqUhMb2nuy5wgIP0CSJ+5y8B8GMGlZ5G:zvqSye+ElGdqU7uy5w9WMy8N5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
5008	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 4648	1492	60459877f1db91d5fdc7c8c418daba80_NeikiAnalytics.exe	84
PID 1492 wrote to memory of 4648	1492	60459877f1db91d5fdc7c8c418daba80_NeikiAnalytics.exe	84
PID 1492 wrote to memory of 4648	1492	60459877f1db91d5fdc7c8c418daba80_NeikiAnalytics.exe	84
PID 4648 wrote to memory of 5008	4648	cmd.exe	85
PID 4648 wrote to memory of 5008	4648	cmd.exe	85
PID 4648 wrote to memory of 5008	4648	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\60459877f1db91d5fdc7c8c418daba80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\60459877f1db91d5fdc7c8c418daba80_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:5008

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
89333906f6f83a758babc552239d0e7b

SHA1
1365fe72a8035705c34fbc271f4251c78cba86af

SHA256
ca10cdcf17e37a332015eddec68cea3e0208b00ad494c98668e0e15879a14fec

SHA512
df233ce84b14202ce81b758a788c4fd16200acd924d207e4ea646ecd9817b486ddb26dc9454f4ee4b9e22583fcaa67470ed0cdb7c774f9ed6b61560c09d0ea27

Download Submit
memory/1492-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5008-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download