a165485e9ef99c2c3c692cbdc27a76120b60901c81423719e018953397ed2508

Analysis

max time kernel
140s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:15

Target

a1b35b93a2e6c0e96f463324913c9210_NeikiAnalytics.exe
Size

79KB
MD5

a1b35b93a2e6c0e96f463324913c9210
SHA1

6727380953bc20daa3279ed7b72007f4da84f846
SHA256

a165485e9ef99c2c3c692cbdc27a76120b60901c81423719e018953397ed2508
SHA512

a264bbf2446518b7f2e693e53d8c97664833a41804a0373615ce9164d6bd764fbbcba59377120a40203b776a0249364be87b34ff963f4bb8f8d302d431240b6d
SSDEEP

1536:zvT7uOoAwg4YQn3COQA8AkqUhMb2nuy5wgIP0CSJ+5yvB8GMGlZ5G:zv+OoT3GdqU7uy5w9WMyvN5G

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

[email protected]

pid process

1840 [email protected]

pid	process
1840	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a1b35b93a2e6c0e96f463324913c9210_NeikiAnalytics.execmd.exe

description	pid	process	target process
PID 116 wrote to memory of 3572	116	a1b35b93a2e6c0e96f463324913c9210_NeikiAnalytics.exe	cmd.exe
PID 116 wrote to memory of 3572	116	a1b35b93a2e6c0e96f463324913c9210_NeikiAnalytics.exe	cmd.exe
PID 116 wrote to memory of 3572	116	a1b35b93a2e6c0e96f463324913c9210_NeikiAnalytics.exe	cmd.exe
PID 3572 wrote to memory of 1840	3572	cmd.exe	[email protected]
PID 3572 wrote to memory of 1840	3572	cmd.exe	[email protected]
PID 3572 wrote to memory of 1840	3572	cmd.exe	[email protected]

C:\Users\Admin\AppData\Local\Temp\a1b35b93a2e6c0e96f463324913c9210_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a1b35b93a2e6c0e96f463324913c9210_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3572
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:1840

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
7c6443b20962dcd900d7bd288ff5c429

SHA1
6085762d253328ed5a2d56641a21fdf706309ad3

SHA256
7b3edd69b752a387dfb0e17dc95df69df8b31bba2d382a12588cf3fa7f256e1d

SHA512
516836b4d330ffbe0f626a2b9f84bf8ea819f8dd091177f45714c888463fc9454edf697579fcfaf998a38c6a73f27ec9d8360734591666f808aac807e77e8e7d

Download Submit
memory/116-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1840-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download