d2433f2a72dcbe2909fb13cb73bf38fa4d81c11eac94bfc0670f35df6aca8532

Analysis

max time kernel
92s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 21:24

Target

e2d714b6bd1fb522e8417bfe0d079d10_NeikiAnalytics.exe
Size

73KB
MD5

e2d714b6bd1fb522e8417bfe0d079d10
SHA1

93eb1f7749bb8fb5872f640a8e83aebcc7a4d694
SHA256

d2433f2a72dcbe2909fb13cb73bf38fa4d81c11eac94bfc0670f35df6aca8532
SHA512

3306ee7abfaa98aef88d91bfc5df08d31229ae11577974bb292f2ed065cfcf612816e4e9eefeddf37a391059a96d4bb5831719429497833ba5aeaf281c69e55e
SSDEEP

1536:hbpaTkaJRXOTK5QPqfhVWbdsmA+RjPFLC+e5h30ZGUGf2g:h0rRX+NPqfcxA+HFsh3Og

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2512	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 1104	4008	e2d714b6bd1fb522e8417bfe0d079d10_NeikiAnalytics.exe	82
PID 4008 wrote to memory of 1104	4008	e2d714b6bd1fb522e8417bfe0d079d10_NeikiAnalytics.exe	82
PID 4008 wrote to memory of 1104	4008	e2d714b6bd1fb522e8417bfe0d079d10_NeikiAnalytics.exe	82
PID 1104 wrote to memory of 2512	1104	cmd.exe	83
PID 1104 wrote to memory of 2512	1104	cmd.exe	83
PID 1104 wrote to memory of 2512	1104	cmd.exe	83
PID 2512 wrote to memory of 772	2512	[email protected]	84
PID 2512 wrote to memory of 772	2512	[email protected]	84
PID 2512 wrote to memory of 772	2512	[email protected]	84

C:\Users\Admin\AppData\Local\Temp\e2d714b6bd1fb522e8417bfe0d079d10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e2d714b6bd1fb522e8417bfe0d079d10_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:772

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
84d8c07f4245d0ac10758f7beff886fc

SHA1
4285edb9071bf9343f95c0e91b002105862f4003

SHA256
edaf3cebd3e8ed5d69e04f20a8ebd5784a710f5f9f7c3e9154b9369c5b94d058

SHA512
c2a3c7290481c3b4c04a074c1c709c312bd5d56c9791448c11f160a1180aa3989d14c52bcf3f4005bfe4250c09125abb2d1b0252bdd881d548b2277778b0667b

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/2512-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4008-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download