370d29e147c3b64b16100053b378e41c524b87c2157ca6d17a70f578ffb46cfd

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 22:00

Target

0cb7679b156c293b16fc71da458160b0_NeikiAnalytics.exe
Size

73KB
MD5

0cb7679b156c293b16fc71da458160b0
SHA1

b6f997a39d9cc67a84f0656199b6be6c21081d42
SHA256

370d29e147c3b64b16100053b378e41c524b87c2157ca6d17a70f578ffb46cfd
SHA512

08ee2c80bd67da4df378846d6c8916c78fecb32eb28eeea7631f94d44e6c1d4c9f1ea916aafb26b8b1aa9ca7c751d7516e55d23c95064b3d57f6298c82897d03
SSDEEP

1536:hbOcfRDzu+CK5QPqfhVWbdsmA+RjPFLC+e5hw0ZGUGf2g:hqSRe+CNPqfcxA+HFshwOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
920	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 1280	3948	0cb7679b156c293b16fc71da458160b0_NeikiAnalytics.exe	84
PID 3948 wrote to memory of 1280	3948	0cb7679b156c293b16fc71da458160b0_NeikiAnalytics.exe	84
PID 3948 wrote to memory of 1280	3948	0cb7679b156c293b16fc71da458160b0_NeikiAnalytics.exe	84
PID 1280 wrote to memory of 920	1280	cmd.exe	85
PID 1280 wrote to memory of 920	1280	cmd.exe	85
PID 1280 wrote to memory of 920	1280	cmd.exe	85
PID 920 wrote to memory of 2352	920	[email protected]	86
PID 920 wrote to memory of 2352	920	[email protected]	86
PID 920 wrote to memory of 2352	920	[email protected]	86

C:\Users\Admin\AppData\Local\Temp\0cb7679b156c293b16fc71da458160b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0cb7679b156c293b16fc71da458160b0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:920
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2352

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
e5b142ebb0ff17dad151b500d9def069

SHA1
9c3b07528cf779e06f3c1cfce4089aed7a9572ba

SHA256
c978a0530d6fe43d9a25501635fa381ad288e5128c7d3438fc03a8e5ef150886

SHA512
130ecd36a62d5e8bf2f2b03b1650b01cec58b081e5606c4280f217b2446ba91f084207c96429225bb703b378e7244a471c605f85a66a161b1111f8abf0f51da0

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/920-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3948-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download