835438a11dc42e9a4da4c54b54846c612a77301b70b3eb76ba88762f916fcee3

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 21:10

Target

06da5290157aa37434ee977fc69273f0_NeikiAnalytics.exe
Size

73KB
MD5

06da5290157aa37434ee977fc69273f0
SHA1

795887d0e5c0156a09da9aacbcd356704beff657
SHA256

835438a11dc42e9a4da4c54b54846c612a77301b70b3eb76ba88762f916fcee3
SHA512

44fe7a9eb0a63b72b15c8e58cf782adf5299e589ca49b2b8a971493799ea2eabe5d2e4f5a2009a4344de4719e9d1f1d790171c815a2f3472f85d6591c67b6db4
SSDEEP

1536:hbb0lxBRoeykzpWUOK5QPqfhVWbdsmA+RjPFLC+e5hR0ZGUGf2g:hHsRoZupWUONPqfcxA+HFshROg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2024	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 1424	4480	06da5290157aa37434ee977fc69273f0_NeikiAnalytics.exe	84
PID 4480 wrote to memory of 1424	4480	06da5290157aa37434ee977fc69273f0_NeikiAnalytics.exe	84
PID 4480 wrote to memory of 1424	4480	06da5290157aa37434ee977fc69273f0_NeikiAnalytics.exe	84
PID 1424 wrote to memory of 2024	1424	cmd.exe	85
PID 1424 wrote to memory of 2024	1424	cmd.exe	85
PID 1424 wrote to memory of 2024	1424	cmd.exe	85
PID 2024 wrote to memory of 1448	2024	[email protected]	86
PID 2024 wrote to memory of 1448	2024	[email protected]	86
PID 2024 wrote to memory of 1448	2024	[email protected]	86

C:\Users\Admin\AppData\Local\Temp\06da5290157aa37434ee977fc69273f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\06da5290157aa37434ee977fc69273f0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:1448

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
989928813e5337a8ea57d5dcceddb9e2

SHA1
9786bbff780927a3d9748473ab9bcfd50941c2ff

SHA256
509c5741287c91673591f60194368fae4b394a49bee569f685ce05c63c42404e

SHA512
3547abd2ba5a6336a6be0bcf6d788d881216977e3f42434f27a259a52deb5242c26678d2c31dbde2505e2f18bcbaec59c3d671edbd028fedf0e105d77394b619

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/2024-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4480-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download