dad83ef030e6ae5b1cf8a954e91e136cd520f5dfb929752a19427530862b7387

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 23:30

Target

8ee869bd90a24cf1b18f1a0241dfdb80_NeikiAnalytics.exe
Size

73KB
MD5

8ee869bd90a24cf1b18f1a0241dfdb80
SHA1

2d35e66d78a6d687223636a7479914a19f2b4721
SHA256

dad83ef030e6ae5b1cf8a954e91e136cd520f5dfb929752a19427530862b7387
SHA512

bb48c8d32c4016f53a7edfc01920410662f17263b39a61138f491985188c91b3c956ff36c463aadd60619366e497f9c9b3a2ee55a2b6a1cc12fe39467b126f11
SSDEEP

1536:hbLRHTJCwUiK5QPqfhVWbdsmA+RjPFLC+e5hN0ZGUGf2g:hPVEw3NPqfcxA+HFshNOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
764	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 3824	3088	8ee869bd90a24cf1b18f1a0241dfdb80_NeikiAnalytics.exe	83
PID 3088 wrote to memory of 3824	3088	8ee869bd90a24cf1b18f1a0241dfdb80_NeikiAnalytics.exe	83
PID 3088 wrote to memory of 3824	3088	8ee869bd90a24cf1b18f1a0241dfdb80_NeikiAnalytics.exe	83
PID 3824 wrote to memory of 764	3824	cmd.exe	84
PID 3824 wrote to memory of 764	3824	cmd.exe	84
PID 3824 wrote to memory of 764	3824	cmd.exe	84
PID 764 wrote to memory of 4136	764	[email protected]	85
PID 764 wrote to memory of 4136	764	[email protected]	85
PID 764 wrote to memory of 4136	764	[email protected]	85

C:\Users\Admin\AppData\Local\Temp\8ee869bd90a24cf1b18f1a0241dfdb80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8ee869bd90a24cf1b18f1a0241dfdb80_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:764
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:4136

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
64daa14492775ccbb7cfa7f648fa2bf0

SHA1
85e64335b4cfdf494cc3a010b5681ace7dd81d4b

SHA256
9c6acde646064ade78cc5724e8f883c43421267cabf1db9c5f43ebe9d103d169

SHA512
4058baf1bfe1b3a7ddd7c3b8b098b4c4edeeea7046af26734b68eb5b2e3b518520fcaec3b3ae49eca2ae0705eebdee496e47c558da422fa6f9bca5ddb6fd3515

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/764-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3088-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download