7b076362fae15ef791ec5813b253f76d7373ba150346514770809b7580ee70d5

Analysis

max time kernel
133s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 08:22

Target

3adb848e39754a2e2985694a75159d60_NeikiAnalytics.exe
Size

73KB
MD5

3adb848e39754a2e2985694a75159d60
SHA1

5e4a4ebe47fcb61413b60774ab8e2328f96daf5f
SHA256

7b076362fae15ef791ec5813b253f76d7373ba150346514770809b7580ee70d5
SHA512

c41070b2bb9eac1d5686072ff4726d4549c3ff0b749af3857d0fa4db88c80c34b57c7d6e35983bf6b14b2d321f3a9826c4d43d220fb8208448bd2b17b248b5da
SSDEEP

1536:hb/jvQTwIEK5QPqfhVWbdsmA+RjPFLC+e5h+0ZGUGf2g:hbj40IENPqfcxA+HFsh+Og

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4528	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 2196	4444	3adb848e39754a2e2985694a75159d60_NeikiAnalytics.exe	83
PID 4444 wrote to memory of 2196	4444	3adb848e39754a2e2985694a75159d60_NeikiAnalytics.exe	83
PID 4444 wrote to memory of 2196	4444	3adb848e39754a2e2985694a75159d60_NeikiAnalytics.exe	83
PID 2196 wrote to memory of 4528	2196	cmd.exe	84
PID 2196 wrote to memory of 4528	2196	cmd.exe	84
PID 2196 wrote to memory of 4528	2196	cmd.exe	84
PID 4528 wrote to memory of 1112	4528	[email protected]	85
PID 4528 wrote to memory of 1112	4528	[email protected]	85
PID 4528 wrote to memory of 1112	4528	[email protected]	85

C:\Users\Admin\AppData\Local\Temp\3adb848e39754a2e2985694a75159d60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3adb848e39754a2e2985694a75159d60_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4528
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:1112

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
68d090366ec5e108a820d2403aa6ce7e

SHA1
07a3134efa69f77ae27f36ba90684db9f7399020

SHA256
293dce1236ba7be9089c03eaf0f2455f3591c3c046c8757b037fed0ba4dcdff4

SHA512
6a9d89da3bde71e6e1c98ed96b33875028b3cf220ad81f90e7bf33c2f9aa222011ff5505a1a38e8b123cc999e5914b3b3f5b5200ed42d4f25d7a277bdf7d50c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/4444-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4528-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download