6a2e4715681825e187788df257a2581622166186014f7e9a6bdc53fceb90056d

Analysis

max time kernel
93s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 00:14

Target

1d30ecc0f483665f808c6ae71724cf70_NeikiAnalytics.exe
Size

79KB
MD5

1d30ecc0f483665f808c6ae71724cf70
SHA1

dd8509d712a2fd63887e0c72d8603d80d7eb1b24
SHA256

6a2e4715681825e187788df257a2581622166186014f7e9a6bdc53fceb90056d
SHA512

6436775b5c63a39e1e3e0da6b6b55b69cb93abe36aedfea29134cdf46ad3b453cee139159cdde2377cf0388b1e2060b9ebd9db7fa780860c6147a90e2df450d7
SSDEEP

1536:zvDsG4JxfZRe6RIFnzUmJfOQA8AkqUhMb2nuy5wgIP0CSJ+5y2B8GMGlZ5G:zvYc5zpJWGdqU7uy5w9WMy2N5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2156	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 4308	5008	1d30ecc0f483665f808c6ae71724cf70_NeikiAnalytics.exe	83
PID 5008 wrote to memory of 4308	5008	1d30ecc0f483665f808c6ae71724cf70_NeikiAnalytics.exe	83
PID 5008 wrote to memory of 4308	5008	1d30ecc0f483665f808c6ae71724cf70_NeikiAnalytics.exe	83
PID 4308 wrote to memory of 2156	4308	cmd.exe	84
PID 4308 wrote to memory of 2156	4308	cmd.exe	84
PID 4308 wrote to memory of 2156	4308	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\1d30ecc0f483665f808c6ae71724cf70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1d30ecc0f483665f808c6ae71724cf70_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2156

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
f63a4a42d0cf679707f6f1bc1ad8cb26

SHA1
f8291aca9b7916a7a57548c10dd73a953cefa7c7

SHA256
a43a9e55f86e84a1385a62c673a4a48fced89c5d1f99cef5a9d08f469bff6ffb

SHA512
c87fa70e1a40e275d456eb13ed4376447f57c73756fc0e0b867878fad4f6320b953c724802463a7261e045c1a8b43e82208e44adc5e342f98467ff6922238dcc

Download Submit
memory/2156-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5008-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download