dacfac76f6d439c9ec1d7b64550d79179f34d794d1549fd3fdd8ce17e4a0d699

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 03:01

Target

61bb126c32ff8d1c1aaed37dbfbfd640_NeikiAnalytics.exe
Size

73KB
MD5

61bb126c32ff8d1c1aaed37dbfbfd640
SHA1

04f4edbd419a5ecd9c9dd9d185735f8f3456658f
SHA256

dacfac76f6d439c9ec1d7b64550d79179f34d794d1549fd3fdd8ce17e4a0d699
SHA512

b5fd9415c914fa498f45cfd2254a810022151b1b54ff634b3da48911241ee2e5d5bc62c3696baad341710a828acf4b27fd098fa4eba73706831fd3a0e62c6b3f
SSDEEP

1536:hbe+S1N9/OqYMK5QPqfhVWbdsmA+RjPFLC+e5hR0ZGUGf2g:ho1/Oq/NPqfcxA+HFshROg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
220	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2260	2624	61bb126c32ff8d1c1aaed37dbfbfd640_NeikiAnalytics.exe	85
PID 2624 wrote to memory of 2260	2624	61bb126c32ff8d1c1aaed37dbfbfd640_NeikiAnalytics.exe	85
PID 2624 wrote to memory of 2260	2624	61bb126c32ff8d1c1aaed37dbfbfd640_NeikiAnalytics.exe	85
PID 2260 wrote to memory of 220	2260	cmd.exe	86
PID 2260 wrote to memory of 220	2260	cmd.exe	86
PID 2260 wrote to memory of 220	2260	cmd.exe	86
PID 220 wrote to memory of 3496	220	[email protected]	87
PID 220 wrote to memory of 3496	220	[email protected]	87
PID 220 wrote to memory of 3496	220	[email protected]	87

C:\Users\Admin\AppData\Local\Temp\61bb126c32ff8d1c1aaed37dbfbfd640_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\61bb126c32ff8d1c1aaed37dbfbfd640_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:220
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:3496

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
b1c084fb138df01348406f00752d0bf3

SHA1
06270f389e79dfc643263bcb5835a56714d22129

SHA256
9f3fb568148503e6f0cd78f25e29779ec65e7b0c6a682f3f7098b9603c7efeba

SHA512
88d36ddffa1963c56171e7025a9e83664c431a51d070e1c936676a06420f44eed9433472061927f64af3324e309eb246aa0868ec9be98ca34f60fd37800907e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/220-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2624-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download