7a4d9fc9aab51125d3b931a19f9f44df65ca7f9322a93f4b53ef866c3933b34b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 21:29

Target

5648dd63870a6a9593cd4b9a83d98ce0_NeikiAnalytics.exe
Size

79KB
MD5

5648dd63870a6a9593cd4b9a83d98ce0
SHA1

11b802c4305416faf39a3fb37c0b9ed27d372a5c
SHA256

7a4d9fc9aab51125d3b931a19f9f44df65ca7f9322a93f4b53ef866c3933b34b
SHA512

36d2c600d4e96e86366c2e3a25379040f3e3c458510f89be48f2eb245a63157f5299c95924111dfcf39c52ea54793dc6ebbd0cedfc11febffdae7c7e294ca283
SSDEEP

1536:zvpySxR4aEN4w0CP3YwhOQA8AkqUhMb2nuy5wgIP0CSJ+5yzB8GMGlZ5G:zvzxcpWJGdqU7uy5w9WMyzN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4700	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 4868	3500	5648dd63870a6a9593cd4b9a83d98ce0_NeikiAnalytics.exe	84
PID 3500 wrote to memory of 4868	3500	5648dd63870a6a9593cd4b9a83d98ce0_NeikiAnalytics.exe	84
PID 3500 wrote to memory of 4868	3500	5648dd63870a6a9593cd4b9a83d98ce0_NeikiAnalytics.exe	84
PID 4868 wrote to memory of 4700	4868	cmd.exe	85
PID 4868 wrote to memory of 4700	4868	cmd.exe	85
PID 4868 wrote to memory of 4700	4868	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\5648dd63870a6a9593cd4b9a83d98ce0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5648dd63870a6a9593cd4b9a83d98ce0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:4700

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
cf596466e341ef9461271a7886b8cca4

SHA1
abe950f75157473da4ac7b4453346e9dd4ae8f13

SHA256
36fdb3616a0fed1db61754ff8b02daf5168b2f903fa4d8d5e57b8301ec9c2b2d

SHA512
22464b3a4d32c28705a4544e79409b4ebf568edba5ffccc0461c2fe2c11fda92a02d0c6ce08aec66ff49e2e0b9ef634635e5421099971f6de6c39f2fd3a0e782

Download Submit
memory/3500-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4700-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download