959cbbc86acb29636f637ba417c9bc7187dc420ec1abb168bb569e1ecb3f075f

Analysis

max time kernel
94s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 08:54

Target

e2fd60427a5ea5c84187c5163b025b40_NeikiAnalytics.exe
Size

79KB
MD5

e2fd60427a5ea5c84187c5163b025b40
SHA1

ff39f24294bc4e8caf286d493184105a668016b9
SHA256

959cbbc86acb29636f637ba417c9bc7187dc420ec1abb168bb569e1ecb3f075f
SHA512

3dc84f9f9b83d7e2d32a1a17319a93c4a6944dc6601a82ca0a4e76bae9096ba5c147ced76d83be3933376f8850c97e9ea2d0c808aaf25f4c1c3216daf88c8551
SSDEEP

1536:zvKoxeJSer4voclnVU+GNOQA8AkqUhMb2nuy5wgIP0CSJ+5yhB8GMGlZ5G:zvBMnr4hlnViUGdqU7uy5w9WMyhN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3292	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 4940	208	e2fd60427a5ea5c84187c5163b025b40_NeikiAnalytics.exe	83
PID 208 wrote to memory of 4940	208	e2fd60427a5ea5c84187c5163b025b40_NeikiAnalytics.exe	83
PID 208 wrote to memory of 4940	208	e2fd60427a5ea5c84187c5163b025b40_NeikiAnalytics.exe	83
PID 4940 wrote to memory of 3292	4940	cmd.exe	84
PID 4940 wrote to memory of 3292	4940	cmd.exe	84
PID 4940 wrote to memory of 3292	4940	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\e2fd60427a5ea5c84187c5163b025b40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e2fd60427a5ea5c84187c5163b025b40_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:3292

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
68b41b704f2ea219ab2ae1647e97aec5

SHA1
d003aeddecbda25147ea77a2788d253f4e4a525e

SHA256
bf5b9e63cff976a20d03f953be3abf08b4a119d10ccd792c24ee9bca9f53641f

SHA512
83dde42a34c05d262115f3b0f7c1dc7b9f02d1a2e7168bf56f7877e72038f84b79ce736eb5ba5839670702d61af4ca5513d455e8f216a20c0d6787eebf96dc8a

Download Submit
memory/208-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3292-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download