724a050fffa5c2e8ab4e69af82bd085fd2b515b3a4d39b3480c19bf0d24c4f83

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 17:29

Target

0377c809daa5eef9e363b12b2e800aa0_NeikiAnalytics.exe
Size

79KB
MD5

0377c809daa5eef9e363b12b2e800aa0
SHA1

4dcd3a9bb29518c715af47c656ee3e45b1a24ebd
SHA256

724a050fffa5c2e8ab4e69af82bd085fd2b515b3a4d39b3480c19bf0d24c4f83
SHA512

5a87114cf40260d5490d26b1e175efae8b5b22343ce065d0fca13da481e1f4baf7a5c378d0fa1d5bde51de697506eded23b2e22e424706806842387e2c262fc5
SSDEEP

1536:zvtCL7dPmK9gv/OQA8AkqUhMb2nuy5wgIP0CSJ+5yxB8GMGlZ5G:zvt+uKa2GdqU7uy5w9WMyxN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4832	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 3552	3644	0377c809daa5eef9e363b12b2e800aa0_NeikiAnalytics.exe	82
PID 3644 wrote to memory of 3552	3644	0377c809daa5eef9e363b12b2e800aa0_NeikiAnalytics.exe	82
PID 3644 wrote to memory of 3552	3644	0377c809daa5eef9e363b12b2e800aa0_NeikiAnalytics.exe	82
PID 3552 wrote to memory of 4832	3552	cmd.exe	83
PID 3552 wrote to memory of 4832	3552	cmd.exe	83
PID 3552 wrote to memory of 4832	3552	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\0377c809daa5eef9e363b12b2e800aa0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0377c809daa5eef9e363b12b2e800aa0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:4832

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
02fb550b9bb32ff11546aa214c5f4e00

SHA1
15d1c7fc7762381b74e740a91637e3c4ddab79de

SHA256
1280d1e4471fe54d5e324d4daf3e3d1c6d67cb825fdf684c60a76787b7eb87fa

SHA512
ee22537a375995b07278ce2020f8dc7f93f634972a43f128201f671d42dec9f6ca6fc587c20714b1b5096f6fe747f038d50214b3f7eac8017b7f8443bd86f300

Download Submit
memory/3644-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4832-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download