63614148f6599f0799c8879693701398f1ffa3ca1a455a75ae5bff6204fedb53

Analysis

max time kernel
93s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 03:32

Target

75513e9e9e167ba106de50b1f911ff50_NeikiAnalytics.exe
Size

73KB
MD5

75513e9e9e167ba106de50b1f911ff50
SHA1

8f9b44ab3bde90188d6de69f1bb0877f33c558b5
SHA256

63614148f6599f0799c8879693701398f1ffa3ca1a455a75ae5bff6204fedb53
SHA512

cf0f1b0d7dbe48d900bb7e4c36c510e7a92e8d0d33c02fbd6c1dc21887acfdaf2879a9aa2b940a043fe3a0fc09b644047b668546fd4c604ff44b4152d8e92067
SSDEEP

1536:hb6CZbDT3dl2ZrcnK5QPqfhVWbdsmA+RjPFLC+e5hM0ZGUGf2g:h3T3dl2BoNPqfcxA+HFshMOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2548	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 2156	224	75513e9e9e167ba106de50b1f911ff50_NeikiAnalytics.exe	83
PID 224 wrote to memory of 2156	224	75513e9e9e167ba106de50b1f911ff50_NeikiAnalytics.exe	83
PID 224 wrote to memory of 2156	224	75513e9e9e167ba106de50b1f911ff50_NeikiAnalytics.exe	83
PID 2156 wrote to memory of 2548	2156	cmd.exe	84
PID 2156 wrote to memory of 2548	2156	cmd.exe	84
PID 2156 wrote to memory of 2548	2156	cmd.exe	84
PID 2548 wrote to memory of 2116	2548	[email protected]	85
PID 2548 wrote to memory of 2116	2548	[email protected]	85
PID 2548 wrote to memory of 2116	2548	[email protected]	85

C:\Users\Admin\AppData\Local\Temp\75513e9e9e167ba106de50b1f911ff50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\75513e9e9e167ba106de50b1f911ff50_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2116

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
42c9d8b2cee524751b5ddfdfb80cdeae

SHA1
7dc8c5bb0561277c65d7dc8be37e945b9582a616

SHA256
80ff9a3882122d14662a23d83909b70776b06935618c05812ce421a26b30dac0

SHA512
bb407c643dc24182b8a190ec711802349154bdeebc3d4d7c1955de5e9ccbaeff55d9f755862bd595cd015bb26c237e4eece3b1113c8c2ae6e17c968c53020ce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/224-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2548-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download