575dbeb8ac5b64ebb09c67ede87e9172af332aa16e5bf6ac0feaf0eb853c20ba

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 08:51

Target

3c0b7227b05c65110fba57c0e9837300_NeikiAnalytics.exe
Size

79KB
MD5

3c0b7227b05c65110fba57c0e9837300
SHA1

fca94166c61946ebeb3c95874a1709209eb9867b
SHA256

575dbeb8ac5b64ebb09c67ede87e9172af332aa16e5bf6ac0feaf0eb853c20ba
SHA512

7df60ee74291d49ce3df473c733db9c228241b5be416722e7c2a84288ff243f7eb78aa2d345718830406ce723e88a70679c63ba199443180a9a019b9b099358b
SSDEEP

1536:zv0IAhkxR/QlJUOQA8AkqUhMb2nuy5wgIP0CSJ+5yqB8GMGlZ5G:zvKWxR/IHGdqU7uy5w9WMyqN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1032	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 3456	3004	3c0b7227b05c65110fba57c0e9837300_NeikiAnalytics.exe	83
PID 3004 wrote to memory of 3456	3004	3c0b7227b05c65110fba57c0e9837300_NeikiAnalytics.exe	83
PID 3004 wrote to memory of 3456	3004	3c0b7227b05c65110fba57c0e9837300_NeikiAnalytics.exe	83
PID 3456 wrote to memory of 1032	3456	cmd.exe	84
PID 3456 wrote to memory of 1032	3456	cmd.exe	84
PID 3456 wrote to memory of 1032	3456	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\3c0b7227b05c65110fba57c0e9837300_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3c0b7227b05c65110fba57c0e9837300_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:1032

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
48da5ec039b006546200eda1e56ccd5b

SHA1
3c42d013cf9d8782250d68a3347a1d0bdcc21481

SHA256
3f2f51bbf59ff2f5bc2d5572e5ec7cc2183b28432ed5a56884778781f68f0801

SHA512
de9650962248bc09a241b61ebee09a36a49a56d6d0b5f093ce48c8783cb20390129b355e2efe113e3789b49b6eb2a0378767d17459f6d9d4b54be697a12ecdad

Download Submit
memory/1032-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3004-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download