38de997040089854b0adf269067a6c1872d033c30d7709955739f8852cdaafc4

Analysis

max time kernel
134s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 01:18

Target

2b1fee297f1e0a9cbb2cd663a1aa9b20_NeikiAnalytics.exe
Size

73KB
MD5

2b1fee297f1e0a9cbb2cd663a1aa9b20
SHA1

794fe5cf2bde75d25fa6a5a3c32c8c4b53af7e84
SHA256

38de997040089854b0adf269067a6c1872d033c30d7709955739f8852cdaafc4
SHA512

7778dd1118aa465e9b70e98f485198ed1d122a9254be8aa50399bb78e2dbbe1dee3cf5f048476c6552673d8c3bd78947963068fb562ff830bfdafe87420c4948
SSDEEP

1536:hbR9z8EVrXYK5QPqfhVWbdsmA+RjPFLC+e5h20ZGUGf2g:hj/YNPqfcxA+HFsh2Og

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2596	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 4724	4564	2b1fee297f1e0a9cbb2cd663a1aa9b20_NeikiAnalytics.exe	84
PID 4564 wrote to memory of 4724	4564	2b1fee297f1e0a9cbb2cd663a1aa9b20_NeikiAnalytics.exe	84
PID 4564 wrote to memory of 4724	4564	2b1fee297f1e0a9cbb2cd663a1aa9b20_NeikiAnalytics.exe	84
PID 4724 wrote to memory of 2596	4724	cmd.exe	85
PID 4724 wrote to memory of 2596	4724	cmd.exe	85
PID 4724 wrote to memory of 2596	4724	cmd.exe	85
PID 2596 wrote to memory of 4444	2596	[email protected]	86
PID 2596 wrote to memory of 4444	2596	[email protected]	86
PID 2596 wrote to memory of 4444	2596	[email protected]	86

C:\Users\Admin\AppData\Local\Temp\2b1fee297f1e0a9cbb2cd663a1aa9b20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2b1fee297f1e0a9cbb2cd663a1aa9b20_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:4444

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
9cd1066ef3278461bf700a6fcd7f62a6

SHA1
93e4447c9e68f093933a31e3ad33f2ec6026c52d

SHA256
1d69abd442d2fd94febac12f03706337678bb8b66c3e4d996f6859d57243f877

SHA512
93ea3b48286dd5611eea2ebc63cfeb97fc7f0cf56e41ca618ef0f9604737d3f66fd79c61844ab743f584d3a9b0f11ea9a11f81e0c583b06eb03d7c7d8c4a4d2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/2596-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4564-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download