98fa2e390742dca1a7e0e718056e66e01007216fd974281a3bad9fbccc637291

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 09:19

Target

4ee95ffbe5ad3a680882d00fc9be4a70_NeikiAnalytics.exe
Size

79KB
MD5

4ee95ffbe5ad3a680882d00fc9be4a70
SHA1

50590a90efa5b578136c1685d34c73981dfcca93
SHA256

98fa2e390742dca1a7e0e718056e66e01007216fd974281a3bad9fbccc637291
SHA512

e79a7cf23b20a7ffed8991b28bdc48dae2e57843cdd5bba2e781409f6033998d2208faadcbf3f1aad85593729b821ccfa431c63c2794dec57c9139fe83fdb4c3
SSDEEP

1536:zv4au8qeCIW7WU8ikh4OQA8AkqUhMb2nuy5wgIP0CSJ+5ydYB8GMGlZ5G:zvkzvIbHZhdGdqU7uy5w9WMyyN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
5092	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 2456	3320	4ee95ffbe5ad3a680882d00fc9be4a70_NeikiAnalytics.exe	84
PID 3320 wrote to memory of 2456	3320	4ee95ffbe5ad3a680882d00fc9be4a70_NeikiAnalytics.exe	84
PID 3320 wrote to memory of 2456	3320	4ee95ffbe5ad3a680882d00fc9be4a70_NeikiAnalytics.exe	84
PID 2456 wrote to memory of 5092	2456	cmd.exe	85
PID 2456 wrote to memory of 5092	2456	cmd.exe	85
PID 2456 wrote to memory of 5092	2456	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\4ee95ffbe5ad3a680882d00fc9be4a70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4ee95ffbe5ad3a680882d00fc9be4a70_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:5092

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
4d14a87f5f8023f606d789b08f6d5ced

SHA1
9f889d1d048a050a25da6ccb78cd2db0f2eb720e

SHA256
dbf30fa67b966318451433f4dc4e6b07197079f04fc1cda36382983256b5ef66

SHA512
34fb0b916a98ff17c4ae8f95bf3d1fdc654530fd1a113092b10b2a8ac39b6afe23e447c3f19eb3d4829c94fc60be1d5e5da2707f5d2f544e27e90c1d0e548c59

Download Submit
memory/3320-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5092-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download