b0f4aa196c1c31bdcfeb7509d22a67cf8d513560d3af987ac21290e1616e72ef

Analysis

max time kernel
134s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 11:44

Target

423ea0ced082b1ff19a12f57029fe9b0_NeikiAnalytics.exe
Size

79KB
MD5

423ea0ced082b1ff19a12f57029fe9b0
SHA1

6da1e5b6cb4836a69d1a04d394773deabe3e0658
SHA256

b0f4aa196c1c31bdcfeb7509d22a67cf8d513560d3af987ac21290e1616e72ef
SHA512

fdf6c30eabea3af4202967828e35167bca2d83f6160c00a9445b997b0195c9c55cb6b280ab68cfada790206408cd2effc86bec413c4c76461abc048003e63207
SSDEEP

1536:zvJudrqrpLekL5OQA8AkqUhMb2nuy5wgIP0CSJ+5yJB8GMGlZ5G:zvJu0rpLXUGdqU7uy5w9WMyJN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4884	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 640	4256	423ea0ced082b1ff19a12f57029fe9b0_NeikiAnalytics.exe	84
PID 4256 wrote to memory of 640	4256	423ea0ced082b1ff19a12f57029fe9b0_NeikiAnalytics.exe	84
PID 4256 wrote to memory of 640	4256	423ea0ced082b1ff19a12f57029fe9b0_NeikiAnalytics.exe	84
PID 640 wrote to memory of 4884	640	cmd.exe	85
PID 640 wrote to memory of 4884	640	cmd.exe	85
PID 640 wrote to memory of 4884	640	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\423ea0ced082b1ff19a12f57029fe9b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\423ea0ced082b1ff19a12f57029fe9b0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:4884

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
bb891c5005f7fac50925126052d6ee39

SHA1
1bc00941b54856f09ac405c009ba2861067d8f5e

SHA256
b9d53a6e15d1bef86d1fb5c5c0a933d736828d1d7e690a2f1711579c443b4db3

SHA512
9dbcce7951ccc5f220cc3a9225cc154f00c95e0d7a56c4bb7c1f7bb271face40320b7755a0e9b2311915490912b57e564e9d8eee54a94df377232a471a28544b

Download Submit
memory/4256-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4884-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download