15bb301d48b83e8e984463366096f49d5e4a61a8957d0a8356c2102cfe23a656

Analysis

max time kernel
131s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 08:04

Target

fa8e4b03fc6316e2a35bb801d2ddaa30_NeikiAnalytics.exe
Size

73KB
MD5

fa8e4b03fc6316e2a35bb801d2ddaa30
SHA1

69c3acf9ca47f41a12b4c6475ef993dafa4668fb
SHA256

15bb301d48b83e8e984463366096f49d5e4a61a8957d0a8356c2102cfe23a656
SHA512

d9dcd3fdbfc16717adcdca69aa6b4da17e4b14cf361ea6ddc05001b40cbe2d0f68fee1d2d6f87cd52021600cc6d182199ae31ff45489084f34a1b74f1540ee63
SSDEEP

1536:hbLvRJ+Q0re1apK5QPqfhVWbdsmA+RjPFLC+e5haD0ZGUGf2g:hnPHCNPqfcxA+HFshAOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
332	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 3620	4576	fa8e4b03fc6316e2a35bb801d2ddaa30_NeikiAnalytics.exe	83
PID 4576 wrote to memory of 3620	4576	fa8e4b03fc6316e2a35bb801d2ddaa30_NeikiAnalytics.exe	83
PID 4576 wrote to memory of 3620	4576	fa8e4b03fc6316e2a35bb801d2ddaa30_NeikiAnalytics.exe	83
PID 3620 wrote to memory of 332	3620	cmd.exe	84
PID 3620 wrote to memory of 332	3620	cmd.exe	84
PID 3620 wrote to memory of 332	3620	cmd.exe	84
PID 332 wrote to memory of 3732	332	[email protected]	85
PID 332 wrote to memory of 3732	332	[email protected]	85
PID 332 wrote to memory of 3732	332	[email protected]	85

C:\Users\Admin\AppData\Local\Temp\fa8e4b03fc6316e2a35bb801d2ddaa30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\fa8e4b03fc6316e2a35bb801d2ddaa30_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:332
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:3732

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
09ef3d0c7e6c4b360c9318be431aa080

SHA1
1f00c36aaf6e5b4af2af7d4d1d39dff56f362939

SHA256
c9b961353360f8d21f35a93220ca17f9d875b995b8545db309ff06ffc8361b50

SHA512
4417a7faeaadfd97ed10fc1d4e4515ad02573aa2a801a7cd59285b9f5810d19a6591a34c89ccc3c27908f6bf8bac275f3f6bb97f3f1c1d0811f55ea6fd663a9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/332-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4576-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download