b5a000093d1f1a8a649a179a4f55c36c0646f5c743779682441fef5a05d199b7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 18:50

Target

0bd3a25c38f2d00fe7436a84a98ae940_NeikiAnalytics.exe
Size

79KB
MD5

0bd3a25c38f2d00fe7436a84a98ae940
SHA1

80131afbda0728db91c99c0e8f6ba9b63569cc80
SHA256

b5a000093d1f1a8a649a179a4f55c36c0646f5c743779682441fef5a05d199b7
SHA512

24b7676b83be3d48b733db913569c91f2617c83d2b2638d47528c83bdd8d7aa924a7e9c54d46c2eb4ec844f89440bd9d937d68d4ff61eeed13d10cc120de5daa
SSDEEP

1536:zvQFxWrhuqoWnMxOQA8AkqUhMb2nuy5wgIP0CSJ+5ylB8GMGlZ5G:zvQFx/0MAGdqU7uy5w9WMylN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4728	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 4380	1588	0bd3a25c38f2d00fe7436a84a98ae940_NeikiAnalytics.exe	83
PID 1588 wrote to memory of 4380	1588	0bd3a25c38f2d00fe7436a84a98ae940_NeikiAnalytics.exe	83
PID 1588 wrote to memory of 4380	1588	0bd3a25c38f2d00fe7436a84a98ae940_NeikiAnalytics.exe	83
PID 4380 wrote to memory of 4728	4380	cmd.exe	84
PID 4380 wrote to memory of 4728	4380	cmd.exe	84
PID 4380 wrote to memory of 4728	4380	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\0bd3a25c38f2d00fe7436a84a98ae940_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0bd3a25c38f2d00fe7436a84a98ae940_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:4728

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
fcf800385ea9fcd52203e0d9a5d993ef

SHA1
091caa357d68b5a6d1971a150d66e9f2658aa956

SHA256
2d586ca2dde7bf61652a8bf2b74599c5feb3ce46d61ac0415d4fb68463202219

SHA512
16af2c743560b10cce0b65283d59dcc9859e6e5ff9fd3cbc8d401c27dc81ccf19b0940784d9806cb9fe32a9ad5358a137056fa993e7b7886782c69717556dd59

Download Submit
memory/1588-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4728-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download