e54051efc211300a9f1600087cfe1b4e6a1e7b717fe1ccb6ee80f47db1c7a4c3

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:01

Target

abde50003c72d01fb298231904a85950_NeikiAnalytics.exe
Size

79KB
MD5

abde50003c72d01fb298231904a85950
SHA1

5c3a74b266c748922d976bf585354f2cbd8942cd
SHA256

e54051efc211300a9f1600087cfe1b4e6a1e7b717fe1ccb6ee80f47db1c7a4c3
SHA512

6a32712016df8b1262de11b04899b95825d08cc2bc18b8fdfdcb1a5b18b55949e74a801961baaacb865f816adb618124fd6b440a95bcea49b65c6dc064fdc62f
SSDEEP

1536:zvQFxWrhuqoWnMxOQA8AkqUhMb2nuy5wgIP0CSJ+5ywB8GMGlZ5G:zvQFx/0MAGdqU7uy5w9WMywN5G

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

[email protected]

pid process

2692 [email protected]

pid	process
2692	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

abde50003c72d01fb298231904a85950_NeikiAnalytics.execmd.exe

description	pid	process	target process
PID 4980 wrote to memory of 2732	4980	abde50003c72d01fb298231904a85950_NeikiAnalytics.exe	cmd.exe
PID 4980 wrote to memory of 2732	4980	abde50003c72d01fb298231904a85950_NeikiAnalytics.exe	cmd.exe
PID 4980 wrote to memory of 2732	4980	abde50003c72d01fb298231904a85950_NeikiAnalytics.exe	cmd.exe
PID 2732 wrote to memory of 2692	2732	cmd.exe	[email protected]
PID 2732 wrote to memory of 2692	2732	cmd.exe	[email protected]
PID 2732 wrote to memory of 2692	2732	cmd.exe	[email protected]

C:\Users\Admin\AppData\Local\Temp\abde50003c72d01fb298231904a85950_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\abde50003c72d01fb298231904a85950_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4980

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c [email protected]
2⤵
- Suspicious use of WriteProcessMemory
PID:2732

C:\Users\Admin\AppData\Local\Temp\[email protected]
[email protected]
3⤵
- Executes dropped EXE
PID:2692

C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize
79KB

MD5
8814ceaf01949cddca4915d52a007cc8

SHA1
80775e2167027ff620a055a846eff80eb65a6fc7

SHA256
ccea018b24082c4730246e0b4a719a886d33b0872769805b20d53229f813ffc2

SHA512
ba0cc9259061cc872842c88be389e072adacb2f4f42aff3167a991abfaceb2b68c086e56266f81e71c9977366c2572643f534557ac38302c7f8718a3c55bdf08

Download Submit
memory/2692-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4980-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download