f872fc4c10cd94c6e0febc841ee512e10b22c54401c0762ff73c1bfd7cc5d4ef

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 11:33

Target

4b374d0aab52c54cafdf8e729dd2bf30_NeikiAnalytics.exe
Size

73KB
MD5

4b374d0aab52c54cafdf8e729dd2bf30
SHA1

86d8f3a659fdb4fe2b31788f4e9628054ee0ef45
SHA256

f872fc4c10cd94c6e0febc841ee512e10b22c54401c0762ff73c1bfd7cc5d4ef
SHA512

22cfe139730a49410263d8c7c5d25864390d08838d14174a5c4f7a6788355e6d409a6a10ed0e947d8ca1fc6b6d8664d39de362b00325c97817c5c439e08919fc
SSDEEP

1536:hbe8ccvU59K5QPqfhVWbdsmA+RjPFLC+e5hYz0ZGUGf2g:haYv+NPqfcxA+HFshiOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3184	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 380	1412	4b374d0aab52c54cafdf8e729dd2bf30_NeikiAnalytics.exe	84
PID 1412 wrote to memory of 380	1412	4b374d0aab52c54cafdf8e729dd2bf30_NeikiAnalytics.exe	84
PID 1412 wrote to memory of 380	1412	4b374d0aab52c54cafdf8e729dd2bf30_NeikiAnalytics.exe	84
PID 380 wrote to memory of 3184	380	cmd.exe	85
PID 380 wrote to memory of 3184	380	cmd.exe	85
PID 380 wrote to memory of 3184	380	cmd.exe	85
PID 3184 wrote to memory of 636	3184	[email protected]	86
PID 3184 wrote to memory of 636	3184	[email protected]	86
PID 3184 wrote to memory of 636	3184	[email protected]	86

C:\Users\Admin\AppData\Local\Temp\4b374d0aab52c54cafdf8e729dd2bf30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4b374d0aab52c54cafdf8e729dd2bf30_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:380
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3184
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:636

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
db18f6729ca20f7c19b4ecc489d5003a

SHA1
0f5cc9f65f0c322deca9ea6b31f7d0b76db1668d

SHA256
6ed4316d047c0a05ad342f5997b95b9a30d9da0be727b996d2568b644fa91f56

SHA512
82aa25e9ad814d26ffb145111183d14b77a277bd93ac49edab44da4f88af47647318412aa03626e764726138cf3a1ea1e0f47b1101cd306908a4030d3b2279f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/1412-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3184-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download