f325d19b6f6bac0b0fd54f3dd4d2663b41b9caeae0f5fb3c2774d064a40d661a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 19:29

Target

f2dbf69167cb3954086bcb382141dc10_NeikiAnalytics.exe
Size

73KB
MD5

f2dbf69167cb3954086bcb382141dc10
SHA1

e6c24c2b84f208c4f900a788989d061948a0341b
SHA256

f325d19b6f6bac0b0fd54f3dd4d2663b41b9caeae0f5fb3c2774d064a40d661a
SHA512

bab8ef46ee9c7af8b679848e93cf0f72d301104ea3a771d5725f0afebf2217c34c581a2a94bd6fbc794f4d1639dfca28f0509089682d5b59a774605248fa53a4
SSDEEP

1536:hbIpRaSX0YMOK5QPqfhVWbdsmA+RjPFLC+e5hMT0ZGUGf2g:hUpUYMONPqfcxA+HFshMTOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1684	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 4296	1324	f2dbf69167cb3954086bcb382141dc10_NeikiAnalytics.exe	83
PID 1324 wrote to memory of 4296	1324	f2dbf69167cb3954086bcb382141dc10_NeikiAnalytics.exe	83
PID 1324 wrote to memory of 4296	1324	f2dbf69167cb3954086bcb382141dc10_NeikiAnalytics.exe	83
PID 4296 wrote to memory of 1684	4296	cmd.exe	84
PID 4296 wrote to memory of 1684	4296	cmd.exe	84
PID 4296 wrote to memory of 1684	4296	cmd.exe	84
PID 1684 wrote to memory of 4112	1684	[email protected]	85
PID 1684 wrote to memory of 4112	1684	[email protected]	85
PID 1684 wrote to memory of 4112	1684	[email protected]	85

C:\Users\Admin\AppData\Local\Temp\f2dbf69167cb3954086bcb382141dc10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\f2dbf69167cb3954086bcb382141dc10_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1684
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 16256.exe
      4⤵
      PID:4112

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
73921015e1db82e880287005ac767612

SHA1
077d6d06876bd36289a57833c5e9d6a57cbb2209

SHA256
4c1627c438a63f0e809abce881a4f9b28af581a8beb08926cbb7378aa5006ca4

SHA512
03d2e86d8c6e5a565952fd83521ba75691ac4a874716c5c619489d5a2415c3a4f4ddaefdb35759d82dd69c0018f167019401b44a63f6b810cfa0ee7fa72fcc73

Download Submit
C:\Users\Admin\AppData\Local\Temp\16256.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/1324-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1684-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download