ce3e76caa45a87af19623c62f6537b39eb71869452aa7f250ca6148c47306d52

Analysis

max time kernel
92s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 03:06

Target

74a00d3bd529cc8ad80b0e8d04d24020_NeikiAnalytics.exe
Size

73KB
MD5

74a00d3bd529cc8ad80b0e8d04d24020
SHA1

381fc50028bbacc454e81e044599c7760456d84f
SHA256

ce3e76caa45a87af19623c62f6537b39eb71869452aa7f250ca6148c47306d52
SHA512

6a25e701503ffa86520b2d9d567e92d4399edd2a2a681fbbca8f9b26fe430171e8013b74ffdd1b8635fa6097f9d265bdde5de2639285dd6dc0661e1a547d5ae6
SSDEEP

1536:hbBmaWDwK5QPqfhVWbdsmA+RjPFLC+e5hSQ0ZGUGf2g:hNmncNPqfcxA+HFshXOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1464	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 1168	4468	74a00d3bd529cc8ad80b0e8d04d24020_NeikiAnalytics.exe	82
PID 4468 wrote to memory of 1168	4468	74a00d3bd529cc8ad80b0e8d04d24020_NeikiAnalytics.exe	82
PID 4468 wrote to memory of 1168	4468	74a00d3bd529cc8ad80b0e8d04d24020_NeikiAnalytics.exe	82
PID 1168 wrote to memory of 1464	1168	cmd.exe	83
PID 1168 wrote to memory of 1464	1168	cmd.exe	83
PID 1168 wrote to memory of 1464	1168	cmd.exe	83
PID 1464 wrote to memory of 528	1464	[email protected]	84
PID 1464 wrote to memory of 528	1464	[email protected]	84
PID 1464 wrote to memory of 528	1464	[email protected]	84

C:\Users\Admin\AppData\Local\Temp\74a00d3bd529cc8ad80b0e8d04d24020_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\74a00d3bd529cc8ad80b0e8d04d24020_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1464
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:528

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
de67977c292fd656a3b0db45c6094844

SHA1
7514554759aca071a3743536dc798680e8816c65

SHA256
a90b9082a716dfda90dc7bb20ad9ac3a6658d4fd02698075e5a87e1695fa84cb

SHA512
cf1a6cd3fea3beb138bf1cf650b0701d85d3da383f206f5767d5155ced9dde0470ab04bbe82def0a93ecfa35a320e5ee50ab76079ec61e67fc5364fa2e25bfaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/1464-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4468-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download