79ea8b75d1488fcd0639c53bf0faa5f6608a97f58aceca8249ba105f3a84c505

Analysis

max time kernel
91s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 07:56

Target

4bc22d9470781e50a2b14e7275ec2b90_NeikiAnalytics.exe
Size

79KB
MD5

4bc22d9470781e50a2b14e7275ec2b90
SHA1

9b525fa50f45110803504ec7f750d202d4cccb4a
SHA256

79ea8b75d1488fcd0639c53bf0faa5f6608a97f58aceca8249ba105f3a84c505
SHA512

5512a978286378d0b9ee7724854b26925f2f74e8c93c534c2a44bb68845517bfacf6c12fd8597cb90a9f2757757bbaa456e2e405a8f4f5de49224166b2a7986e
SSDEEP

1536:zvXObzfMmFJA4r0BOQA8AkqUhMb2nuy5wgIP0CSJ+5ydB8GMGlZ5G:zvXOnkmw4rdGdqU7uy5w9WMydN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2280	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 1752	2956	4bc22d9470781e50a2b14e7275ec2b90_NeikiAnalytics.exe	84
PID 2956 wrote to memory of 1752	2956	4bc22d9470781e50a2b14e7275ec2b90_NeikiAnalytics.exe	84
PID 2956 wrote to memory of 1752	2956	4bc22d9470781e50a2b14e7275ec2b90_NeikiAnalytics.exe	84
PID 1752 wrote to memory of 2280	1752	cmd.exe	85
PID 1752 wrote to memory of 2280	1752	cmd.exe	85
PID 1752 wrote to memory of 2280	1752	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\4bc22d9470781e50a2b14e7275ec2b90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4bc22d9470781e50a2b14e7275ec2b90_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2280

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
98d0fcde5fc46cf046499d1abb616d35

SHA1
07016996046f5a80193631b147aa5cc74e07bfc8

SHA256
4e25620d595beae0fde72114b4f818ec333eeb54e946286401b2bdd9b60c25f5

SHA512
c6c2e5201812e3ef7d312c3a95a821a3542b557b2bea74e05c045a06587bf46edc5b6ca0c54c2fd928f474eaac184c8f4af0898d92d5226e19051acb0a0b60fa

Download Submit
memory/2280-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2956-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download