41a4d3d6260d4d7d0a8d8a8d7e931cace42f1878213b692c483848b4e0799ca5

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 11:39

Target

41a4d3d6260d4d7d0a8d8a8d7e931cace42f1878213b692c483848b4e0799ca5_NeikiAnalytics.exe
Size

122KB
MD5

1fde2a5a9a6c65cb3e0dafe9c4820f70
SHA1

43adae9ed2445b426a42e7b977df6cb1ebec112c
SHA256

41a4d3d6260d4d7d0a8d8a8d7e931cace42f1878213b692c483848b4e0799ca5
SHA512

6dff88972e9c52b493f6e3c7f0721a992c05f906f7d0e3b02a859d45d0687feacab584758dd0e5841b7f9509f7803ea8bdfb8cc63eb293cca799e942aa32cb3a
SSDEEP

3072:KzltUeOsaYc8mlsoT/PV8ziN/djco3ZGBjMC:unOsaYc8Cso/PVDdjwn

Score

1^/10

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 600 wrote to memory of 2844	600	41a4d3d6260d4d7d0a8d8a8d7e931cace42f1878213b692c483848b4e0799ca5_NeikiAnalytics.exe	83
PID 600 wrote to memory of 2844	600	41a4d3d6260d4d7d0a8d8a8d7e931cace42f1878213b692c483848b4e0799ca5_NeikiAnalytics.exe	83
PID 600 wrote to memory of 2844	600	41a4d3d6260d4d7d0a8d8a8d7e931cace42f1878213b692c483848b4e0799ca5_NeikiAnalytics.exe	83
PID 2844 wrote to memory of 2980	2844	cmd.exe	84
PID 2844 wrote to memory of 2980	2844	cmd.exe	84
PID 2844 wrote to memory of 2980	2844	cmd.exe	84
PID 2980 wrote to memory of 1436	2980	iexpress.exe	85
PID 2980 wrote to memory of 1436	2980	iexpress.exe	85
PID 2980 wrote to memory of 1436	2980	iexpress.exe	85

C:\Users\Admin\AppData\Local\Temp\41a4d3d6260d4d7d0a8d8a8d7e931cace42f1878213b692c483848b4e0799ca5_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\41a4d3d6260d4d7d0a8d8a8d7e931cace42f1878213b692c483848b4e0799ca5_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\43DF.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\41a4d3d6260d4d7d0a8d8a8d7e931cace42f1878213b692c483848b4e0799ca5_NeikiAnalytics.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Windows\SysWOW64\iexpress.exe
    iexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\Windows\SysWOW64\makecab.exe
      C:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"
      4⤵
      PID:1436

C:\Users\Admin\AppData\Local\Temp\43DF.tmp\1.bat

Filesize
1KB

MD5
02dba5f37067292355c6d01a57d4ef48

SHA1
7c67ab3f99fbf7a53018dd295d2968c525db83d9

SHA256
8b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242

SHA512
12201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a

Download Submit
C:\Users\Admin\AppData\Local\Temp\popup.sed

Filesize
122KB

MD5
77a0efa1924a37158fd43d1f9e41f941

SHA1
2054f692c61e2528b80b2961957f572441155cae

SHA256
106ffb21d5258554fb40e704e302189f856a9c77519d017049f3d0c2262f0f39

SHA512
26d73a4fb261b3b4c998f0c16fd104776a2fd6df57d2d001f6e436fe8ac06bf2d3852d4d012f570496c157ec037a9853e45b2c2abdf7e3a5cd4fb22643061c3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\~%TargetName%.DDF

Filesize
724B

MD5
c3ca008abd6997c4b036a7e8be75cb2c

SHA1
05f7a3527bb04c691b08f040f562582035398829

SHA256
29ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3

SHA512
bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083

Download Submit