92845e67919ae48c6c9fad04efc6db5d3407fbf4a1b20057130336b751d4ec11

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 07:16

Target

4a240cd9324cbc518bcf9f58fed9e590_NeikiAnalytics.exe
Size

73KB
MD5

4a240cd9324cbc518bcf9f58fed9e590
SHA1

ff407af6de05673b5d2abb36770621cd43a23e71
SHA256

92845e67919ae48c6c9fad04efc6db5d3407fbf4a1b20057130336b751d4ec11
SHA512

d8546146b92791c41118073284ea0aecf9ebee2661df55f1d9969890bbc5b79e707b39fa779b952605a3a56d547bbfe77337e1e0dbb98831d9a129bad6a84059
SSDEEP

1536:hbPKdNf+D9bJWO2K5QPqfhVWbdsmA+RjPFLC+e5hj0ZGUGf2g:hh9VWhNPqfcxA+HFshjOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1276	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 4600	1448	4a240cd9324cbc518bcf9f58fed9e590_NeikiAnalytics.exe	84
PID 1448 wrote to memory of 4600	1448	4a240cd9324cbc518bcf9f58fed9e590_NeikiAnalytics.exe	84
PID 1448 wrote to memory of 4600	1448	4a240cd9324cbc518bcf9f58fed9e590_NeikiAnalytics.exe	84
PID 4600 wrote to memory of 1276	4600	cmd.exe	85
PID 4600 wrote to memory of 1276	4600	cmd.exe	85
PID 4600 wrote to memory of 1276	4600	cmd.exe	85
PID 1276 wrote to memory of 3248	1276	[email protected]	86
PID 1276 wrote to memory of 3248	1276	[email protected]	86
PID 1276 wrote to memory of 3248	1276	[email protected]	86

C:\Users\Admin\AppData\Local\Temp\4a240cd9324cbc518bcf9f58fed9e590_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4a240cd9324cbc518bcf9f58fed9e590_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1276
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 16256.exe
      4⤵
      PID:3248

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
3a4add281618272d9bd79b8ee7932c06

SHA1
f8786c9033777f7b56fe5033181847936035a7fd

SHA256
a3e3e104e5a7c8bc908bae27af856273dd1237cb08d548c52e9a5057b7874554

SHA512
718ded4aecd8a00039a3557e3b2b73cdf59929066cb36135be0945fff5ff7969ab4bfceda0853fe4fd3b911a6290b1a94146afabd4ac6f63f1bfb22f62a9e3de

Download Submit
C:\Users\Admin\AppData\Local\Temp\16256.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/1276-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1448-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download