35c8737353a97e7ee707eac67af0bd74ca7414cdbeb96e9d71d0af255c7202d3

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 03:14

Target

2fbaf2afcda7b5a5d0b714c3a62fe270_NeikiAnalytics.exe
Size

79KB
MD5

2fbaf2afcda7b5a5d0b714c3a62fe270
SHA1

fef99e9e8ca314fc51167bd400cb7d83ef468cf0
SHA256

35c8737353a97e7ee707eac67af0bd74ca7414cdbeb96e9d71d0af255c7202d3
SHA512

917de4af19ff5fbf3c079f057977b83c31cbd23e1beb3ba58a1d687a40fe81cf1f568f2968237f435f16106e5c4b244634d41ca09c1ebf4d3b4634ba2f37d041
SSDEEP

1536:zvIqTisupYrVjLZhkpkxOQA8AkqUhMb2nuy5wgIP0CSJ+5yWB8GMGlZ5G:zvIqJxLnsGdqU7uy5w9WMyWN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2388	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 3672	3540	2fbaf2afcda7b5a5d0b714c3a62fe270_NeikiAnalytics.exe	83
PID 3540 wrote to memory of 3672	3540	2fbaf2afcda7b5a5d0b714c3a62fe270_NeikiAnalytics.exe	83
PID 3540 wrote to memory of 3672	3540	2fbaf2afcda7b5a5d0b714c3a62fe270_NeikiAnalytics.exe	83
PID 3672 wrote to memory of 2388	3672	cmd.exe	84
PID 3672 wrote to memory of 2388	3672	cmd.exe	84
PID 3672 wrote to memory of 2388	3672	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\2fbaf2afcda7b5a5d0b714c3a62fe270_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2fbaf2afcda7b5a5d0b714c3a62fe270_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2388

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
27b0a99e42a84a901b4c6ff173c8aa4b

SHA1
22b5faf79a8dc3045097db4e53fefe44dec2c521

SHA256
aa75314427cef7a2c639363bdae65f5b3af83847c5cf8c8720b2ec03f0d78805

SHA512
f38b27861ed817d0a9c503d5878aad045f63e648ccc8d4208ece9ed46882cf61851b1fa93409378707c5208848d69b650794d4979bcb751e10bb85a9afe29da2

Download Submit
memory/2388-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3540-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download