ecce1dc6625d14841baccd73e5238a12b08533db49025f8181681cce19aee5d7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:10

Target

b7d4cd4cdafea24b1eee09d1fba4aec0_NeikiAnalytics.exe
Size

79KB
MD5

b7d4cd4cdafea24b1eee09d1fba4aec0
SHA1

f8046d1ad2c8b6beff1f607ab009d3d3f739f51d
SHA256

ecce1dc6625d14841baccd73e5238a12b08533db49025f8181681cce19aee5d7
SHA512

af8eaee15faceb5418e8e15e82233a3b225b10b1deff2b8e847fe02a0f1c784f6629a937bfb0dea013c55082f91f7c89b50de872db81c270cdaa7099d66521cb
SSDEEP

1536:zvxVDuD1AYrOQA8AkqUhMb2nuy5wgIP0CSJ+5yZB8GMGlZ5G:zvPqT6GdqU7uy5w9WMyZN5G

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

[email protected]

pid process

448 [email protected]

pid	process
448	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

b7d4cd4cdafea24b1eee09d1fba4aec0_NeikiAnalytics.execmd.exe

description	pid	process	target process
PID 2564 wrote to memory of 848	2564	b7d4cd4cdafea24b1eee09d1fba4aec0_NeikiAnalytics.exe	cmd.exe
PID 2564 wrote to memory of 848	2564	b7d4cd4cdafea24b1eee09d1fba4aec0_NeikiAnalytics.exe	cmd.exe
PID 2564 wrote to memory of 848	2564	b7d4cd4cdafea24b1eee09d1fba4aec0_NeikiAnalytics.exe	cmd.exe
PID 848 wrote to memory of 448	848	cmd.exe	[email protected]
PID 848 wrote to memory of 448	848	cmd.exe	[email protected]
PID 848 wrote to memory of 448	848	cmd.exe	[email protected]

C:\Users\Admin\AppData\Local\Temp\b7d4cd4cdafea24b1eee09d1fba4aec0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b7d4cd4cdafea24b1eee09d1fba4aec0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:448

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
1665ec583f131d53316ad6c13ada31c7

SHA1
d7fd44e1b0956e189c2afb95f5748263712dbd6e

SHA256
a3a75a5ed3f4fe2f7a53993c49d494a9e4a4ff7f7c997bc82722b68b3010a4fd

SHA512
0efb3cc871296421ee146b181a4562dad3d347819f6a40b0467d50fa111b68921c5b115d423cc3cc39140ffaf580f9c15912c6c9965e13196f61a422fb3ee735

Download Submit
memory/448-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2564-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download