ea66471f6bf62e5e1ad93ba8f74a5541f362cb8193b4c08c0760c3979488bff8

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 07:03

Target

23f51a7ee4a61e03f46e26ad0fced020_NeikiAnalytics.exe
Size

73KB
MD5

23f51a7ee4a61e03f46e26ad0fced020
SHA1

8fc7f45df9d8936dde397be0b040358a7155f103
SHA256

ea66471f6bf62e5e1ad93ba8f74a5541f362cb8193b4c08c0760c3979488bff8
SHA512

7cbcc8c29f5f8c2152f714d21a808feb643b94791b3abad64de141e7ef6897a963fb58a82cb5ab9c67e00de8239258aa2e13747cefee0920d24c6d584c3e896f
SSDEEP

1536:hbDHrvZfAMK5QPqfhVWbdsmA+RjPFLC+e5ho0ZGUGf2g:hvhxNPqfcxA+HFshoOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2008	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 3344	4696	23f51a7ee4a61e03f46e26ad0fced020_NeikiAnalytics.exe	84
PID 4696 wrote to memory of 3344	4696	23f51a7ee4a61e03f46e26ad0fced020_NeikiAnalytics.exe	84
PID 4696 wrote to memory of 3344	4696	23f51a7ee4a61e03f46e26ad0fced020_NeikiAnalytics.exe	84
PID 3344 wrote to memory of 2008	3344	cmd.exe	85
PID 3344 wrote to memory of 2008	3344	cmd.exe	85
PID 3344 wrote to memory of 2008	3344	cmd.exe	85
PID 2008 wrote to memory of 4504	2008	[email protected]	86
PID 2008 wrote to memory of 4504	2008	[email protected]	86
PID 2008 wrote to memory of 4504	2008	[email protected]	86

C:\Users\Admin\AppData\Local\Temp\23f51a7ee4a61e03f46e26ad0fced020_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\23f51a7ee4a61e03f46e26ad0fced020_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:4504

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
0d83708205d90df13cef428caa22403b

SHA1
a99abdbbbe5e54b4798782799640d383409c1336

SHA256
21f8f9b1c4bde99224b45daaa715642a50fe775a4544256a16bfbd16f1b58273

SHA512
02232fef752677c0909580ff1088000f634a2d9de0709729d41172fea8719838c8ea0f79dba1faf4b1dd1910741b7449e9eafefcd62ef15f1ecfff8759a68c3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/2008-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4696-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download