49bde1bdae6e086fdad0dd2aa305d28ca95a765078c77074612666ce4e53370d

Analysis

max time kernel
133s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 23:31

Target

6d0a5282a3bdc5a983c8380edb8a8bc0_NeikiAnalytics.exe
Size

73KB
MD5

6d0a5282a3bdc5a983c8380edb8a8bc0
SHA1

a579395ef205096eaea3f1779369b2996b7c1d0d
SHA256

49bde1bdae6e086fdad0dd2aa305d28ca95a765078c77074612666ce4e53370d
SHA512

6982ecc4214fdb4b2d310c78ca3d80a19f5c5e1a1bafce7f1c82abeee5915be3e6e60a6190fcb99594963d151537b4695f4030b6b1c3d980e2d9359c867e79b7
SSDEEP

1536:hbenS1B1lQd4K5QPqfhVWbdsmA+RjPFLC+e5hQT0ZGUGf2g:hCSL1lQiNPqfcxA+HFshQTOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1132	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2376	1652	6d0a5282a3bdc5a983c8380edb8a8bc0_NeikiAnalytics.exe	84
PID 1652 wrote to memory of 2376	1652	6d0a5282a3bdc5a983c8380edb8a8bc0_NeikiAnalytics.exe	84
PID 1652 wrote to memory of 2376	1652	6d0a5282a3bdc5a983c8380edb8a8bc0_NeikiAnalytics.exe	84
PID 2376 wrote to memory of 1132	2376	cmd.exe	85
PID 2376 wrote to memory of 1132	2376	cmd.exe	85
PID 2376 wrote to memory of 1132	2376	cmd.exe	85
PID 1132 wrote to memory of 3128	1132	[email protected]	86
PID 1132 wrote to memory of 3128	1132	[email protected]	86
PID 1132 wrote to memory of 3128	1132	[email protected]	86

C:\Users\Admin\AppData\Local\Temp\6d0a5282a3bdc5a983c8380edb8a8bc0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6d0a5282a3bdc5a983c8380edb8a8bc0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1132
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:3128

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
c2e895e61a2ea3c573549049aab98cc8

SHA1
c562edfadcdf7f171695bbd308e7ef2f649c450b

SHA256
2dbeaca55cf494c69e179118c0e29c9b0950a09f87b2fa6b949b25511c268cdc

SHA512
7eec78e08ba91d2da63f3f22cbe4086ab587daff9164451115c06660e63998b5b3ecf5fe631ceedab4d09af944742cda502e17ec0fec231452ca0278f2f08343

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/1132-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1652-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download