453af4859f90f6044ab690d721cf69425d0003d8154eecc545e1483d4095e232

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 13:03

Target

9b423d549016a7b882d6613aaf8f9dd0_NeikiAnalytics.exe
Size

79KB
MD5

9b423d549016a7b882d6613aaf8f9dd0
SHA1

4a80969f0dac1065ab63151cd2406e5519b3a8fa
SHA256

453af4859f90f6044ab690d721cf69425d0003d8154eecc545e1483d4095e232
SHA512

0fa330c1b03891b68d1c110d33a33bc503103558de2273288baa8b865790f0a8eb2a67bcd0855f693b08f09bf430697f51402ce57442e24eb3e0140b6c756d58
SSDEEP

1536:zvqdANke+cTyY27OQA8AkqUhMb2nuy5wgIP0CSJ+5y4B8GMGlZ5G:zvqSye+ElGdqU7uy5w9WMy4N5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3596	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 1896	2796	9b423d549016a7b882d6613aaf8f9dd0_NeikiAnalytics.exe	83
PID 2796 wrote to memory of 1896	2796	9b423d549016a7b882d6613aaf8f9dd0_NeikiAnalytics.exe	83
PID 2796 wrote to memory of 1896	2796	9b423d549016a7b882d6613aaf8f9dd0_NeikiAnalytics.exe	83
PID 1896 wrote to memory of 3596	1896	cmd.exe	84
PID 1896 wrote to memory of 3596	1896	cmd.exe	84
PID 1896 wrote to memory of 3596	1896	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\9b423d549016a7b882d6613aaf8f9dd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9b423d549016a7b882d6613aaf8f9dd0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:3596

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
b4751f1b34c94bd711053368006d3e2d

SHA1
0c19c4c7395fdebdbd61e7932d9491b994fe90ea

SHA256
1f4cf432f0daf41b43752c207b4c8dbbf4b65ef221135f1100049ab53729f077

SHA512
dcb955825c20ff9501dc98688b5671b397a903a1715f6ce232e50865bc6badea8b289c54338981989be4a04ff4066912b909b09217fbc25d4147b4ad1919614a

Download Submit
memory/2796-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3596-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download