d18fd706641126291626937aad00345bba5326bdb23893de595d86b716273ada

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 03:00

Target

333c1c2ca82ad8a7a04fa9d63c5c9ab0_NeikiAnalytics.exe
Size

79KB
MD5

333c1c2ca82ad8a7a04fa9d63c5c9ab0
SHA1

2ea4b79a40616db974455db824015401791a6b12
SHA256

d18fd706641126291626937aad00345bba5326bdb23893de595d86b716273ada
SHA512

f170d0b4a06ddda8b7170558eab610619389f4991fdb2f36a3ee9263517693ad7a3896f3b8ae29d70439921a7b9f9d246f6eadc78bfc964dbf210b9f872d6d66
SSDEEP

1536:zv58TL8CZf6esHOQA8AkqUhMb2nuy5wgIP0CSJ+5yz4B8GMGlZ5G:zv5+91suGdqU7uy5w9WMy8N5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
60	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2544	2060	333c1c2ca82ad8a7a04fa9d63c5c9ab0_NeikiAnalytics.exe	83
PID 2060 wrote to memory of 2544	2060	333c1c2ca82ad8a7a04fa9d63c5c9ab0_NeikiAnalytics.exe	83
PID 2060 wrote to memory of 2544	2060	333c1c2ca82ad8a7a04fa9d63c5c9ab0_NeikiAnalytics.exe	83
PID 2544 wrote to memory of 60	2544	cmd.exe	84
PID 2544 wrote to memory of 60	2544	cmd.exe	84
PID 2544 wrote to memory of 60	2544	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\333c1c2ca82ad8a7a04fa9d63c5c9ab0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\333c1c2ca82ad8a7a04fa9d63c5c9ab0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:60

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
56ff0fafeca2d9228805f9b2086f6917

SHA1
06835088a537a3ea40ae8705d9bd178c4d4581af

SHA256
9321005a8ca2ef00c480a28c64801c41b22bd29272ed3a481e2d9d591b881be7

SHA512
7f271db806d59db0bc8a130f1be962e1f168791a3296f4ca5c0851b840632bc70c8d71b9ab08aa801eddf459972a30729300fc4f549ee2810f7f38fbca8f806c

Download Submit
memory/60-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2060-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download