9a6913d04214c43bca3dd670c0e4b53c9247887d505e1d857911cac5491f7f52

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 02:44

Target

8d24a6e1a0917e3b4b772f1d4346b6e0_NeikiAnalytics.exe
Size

79KB
MD5

8d24a6e1a0917e3b4b772f1d4346b6e0
SHA1

64b8b061cc7764bc0e409fc147b4604dc87ca8b2
SHA256

9a6913d04214c43bca3dd670c0e4b53c9247887d505e1d857911cac5491f7f52
SHA512

62cf1649c6e642ef34dd856b26047719af053600cf1bf866062626963256ab64887087f7a8fb34ff546c3d65ad47b4ab1e0fb65b50e0f4f432f7fd3381eb8230
SSDEEP

1536:zvm5Om0rld8Ms1FAOgSmOQA8AkqUhMb2nuy5wgIP0CSJ+5yYB8GMGlZ5G:zvm5OTld8r1QSjGdqU7uy5w9WMyYN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2068	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 2408	1460	8d24a6e1a0917e3b4b772f1d4346b6e0_NeikiAnalytics.exe	84
PID 1460 wrote to memory of 2408	1460	8d24a6e1a0917e3b4b772f1d4346b6e0_NeikiAnalytics.exe	84
PID 1460 wrote to memory of 2408	1460	8d24a6e1a0917e3b4b772f1d4346b6e0_NeikiAnalytics.exe	84
PID 2408 wrote to memory of 2068	2408	cmd.exe	85
PID 2408 wrote to memory of 2068	2408	cmd.exe	85
PID 2408 wrote to memory of 2068	2408	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\8d24a6e1a0917e3b4b772f1d4346b6e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8d24a6e1a0917e3b4b772f1d4346b6e0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2068

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
d2624205f27111d627d6a7ed0f715995

SHA1
dda26c934f055d28affcdec346c8e01f70b23eeb

SHA256
f3a89757b7fb2099cf970ef9a2f85017a28cf144ceabb92b5d9a487907bdaa5c

SHA512
43aa4d86b1cbc941df6765f2b175a76d17449adcae13543d30545c6d6415618e1254c69c37d054085f7383f30ae8f726ce6ea14ad1d2707abfdec38a0183a0e4

Download Submit
memory/1460-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2068-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download