a35abd5237ef7afa0e91b0a16ccc9a15786271b600d7dfb5d6e0d8fc2a58367a

Analysis

max time kernel
132s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 06:38

Target

7e641d14ce1010c764b817b51c1d3970_NeikiAnalytics.exe
Size

73KB
MD5

7e641d14ce1010c764b817b51c1d3970
SHA1

84f69b737e3e0800f9a11d8c99e8e2a9d382dc49
SHA256

a35abd5237ef7afa0e91b0a16ccc9a15786271b600d7dfb5d6e0d8fc2a58367a
SHA512

4086130100de47ad21dadb58568718176311642a2be9290418053e2e96fecf2892fe511e2b6424b04404646e213f77585e23eb6f4bbe97cdec273a53e19c86f8
SSDEEP

1536:hb/pRBv9CNAK5QPqfhVWbdsmA+RjPFLC+e5hP0ZGUGf2g:hVPlCSNPqfcxA+HFshPOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3040	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 1640	3724	7e641d14ce1010c764b817b51c1d3970_NeikiAnalytics.exe	84
PID 3724 wrote to memory of 1640	3724	7e641d14ce1010c764b817b51c1d3970_NeikiAnalytics.exe	84
PID 3724 wrote to memory of 1640	3724	7e641d14ce1010c764b817b51c1d3970_NeikiAnalytics.exe	84
PID 1640 wrote to memory of 3040	1640	cmd.exe	85
PID 1640 wrote to memory of 3040	1640	cmd.exe	85
PID 1640 wrote to memory of 3040	1640	cmd.exe	85
PID 3040 wrote to memory of 948	3040	[email protected]	86
PID 3040 wrote to memory of 948	3040	[email protected]	86
PID 3040 wrote to memory of 948	3040	[email protected]	86

C:\Users\Admin\AppData\Local\Temp\7e641d14ce1010c764b817b51c1d3970_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7e641d14ce1010c764b817b51c1d3970_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:948

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
58bc2d106836c4e8cbd295c85c6423f2

SHA1
5b287c218cbcef6093122ce9a67e9eca0dd7bb44

SHA256
4842c29d51beffc09f4f65291072c6fe369bbe26f32ff2c159110ba3a4a93ccf

SHA512
8f43e01de3854e985448778b6ebb445b0907ab79e0b70b3c201601ddc4c12790513c716b543bfdb915527864d1b1c2e13b0d4413ec92b1132f04a3c3895c97df

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/3040-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3724-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download