5f9ed9415b370e83b6cabc6821e17c9eb3ae64e36f564bb56a658d3cc8602bdc

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 02:02

Target
5fb32fe00cb58c0c7d7d3501df1a1130_NeikiAnalytics.exe
Size 64KB
Sample240530-cggdaaae61
SHA256 5f9ed9415b370e83b6cabc6821e17c9eb3ae64e36f564bb56a658d3cc8602bdc
MD5 5fb32fe00cb58c0c7d7d3501df1a1130
SHA1 6e663343ee3d2935e7ea88b0b9297d8bbf4bf06a
SHA512 0ed0316901d14802dc5b06c785ed94ddb2831a6afe98d4cb143e312dcb5688af49411af26b3866a70d35530056316fe5f8a5fd7e74a0b2a7cf58d83a57154a5d
SSDEEP 768:tCru/e9Uw/E6zy4n8uZ5tUXMJ+fROUmELY2glEbM3j+rd+fpRuO4TW7ReOOG:URTzy48untU8fOMEI3jyYfPT4wOG
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 668	216	5fb32fe00cb58c0c7d7d3501df1a1130_NeikiAnalytics.exe	85
PID 216 wrote to memory of 668	216	5fb32fe00cb58c0c7d7d3501df1a1130_NeikiAnalytics.exe	85
PID 216 wrote to memory of 668	216	5fb32fe00cb58c0c7d7d3501df1a1130_NeikiAnalytics.exe	85
PID 668 wrote to memory of 4764	668	cmd.exe	86
PID 668 wrote to memory of 4764	668	cmd.exe	86
PID 668 wrote to memory of 4764	668	cmd.exe	86
PID 4764 wrote to memory of 3956	4764	iexpress.exe	87
PID 4764 wrote to memory of 3956	4764	iexpress.exe	87
PID 4764 wrote to memory of 3956	4764	iexpress.exe	87

C:\Users\Admin\AppData\Local\Temp\5fb32fe00cb58c0c7d7d3501df1a1130_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5fb32fe00cb58c0c7d7d3501df1a1130_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\545A.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\5fb32fe00cb58c0c7d7d3501df1a1130_NeikiAnalytics.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:668
- - C:\Windows\SysWOW64\iexpress.exe
    iexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\Windows\SysWOW64\makecab.exe
      C:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"
      4⤵
      PID:3956

1.bat

Path C:\Users\Admin\AppData\Local\Temp\545A.tmp\1.bat
Size 1KB
SHA256 8b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
MD5 02dba5f37067292355c6d01a57d4ef48
SHA1 7c67ab3f99fbf7a53018dd295d2968c525db83d9
SHA512 12201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a
MD5 SHA1 SHA512

Submit Download

popup.sed

Path C:\Users\Admin\AppData\Local\Temp\popup.sed
Size 64KB
SHA256 b4852effe3cf3e92a55d5357e318a52ac302f366f132beb4d758e9620437968d
MD5 7b4cba970149ebbabdbf27ec6ee0396e
SHA1 bc26f5e85ca69778f068d0a364c75a7ec7cea036
SHA512 9eae7260aa53f2d71d5c80b2b6273f51bcf4b4d6d817ce80bc3a89fa70cdf97897ccdde55e65704b3d8481efa303a88b6486aadd1eefe3367e974f372c94414e
SSDEEP 768:tCru/e9Uw/E6zy4n8uZ5tUXMJ+fROUmELY2glEbM3j+rd+fpRuO4TW7ReOOE:URTzy48untU8fOMEI3jyYfPT4wOE
MD5 SHA1 SHA512 SSDEEP

Submit Download

~%TargetName%.DDF

Path C:\Users\Admin\AppData\Local\Temp\~%TargetName%.DDF
Size 724B
SHA256 29ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3
MD5 c3ca008abd6997c4b036a7e8be75cb2c
SHA1 05f7a3527bb04c691b08f040f562582035398829
SHA512 bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083
MD5 SHA1 SHA512

Submit Download

memory/216-0-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/216-12-0x0000000000400000-0x0000000000411000-memory.dmp

Download