205a009c83c8d8f814624f479130aefc639b9206be05f0dd006dea8ff957131f

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 03:55

Target

75f5ee0f94c3a0e869cff827578bb540_NeikiAnalytics.exe
Size

79KB
MD5

75f5ee0f94c3a0e869cff827578bb540
SHA1

554b7cfc3272fea9e3ef232fabd9982bb33a0cd4
SHA256

205a009c83c8d8f814624f479130aefc639b9206be05f0dd006dea8ff957131f
SHA512

6831cc7d0e9517e805a031a20d97159df5a32d6b3827767f9fdfda2e8195ac29f8686645c54b8d2e5b5eff1112e53e1958bf458ea6ccd9d8c897b2734e6fda25
SSDEEP

1536:zvpySxR4aEN4w0CP3YwhOQA8AkqUhMb2nuy5wgIP0CSJ+5yEB8GMGlZ5G:zvzxcpWJGdqU7uy5w9WMyEN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
5116	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 1504	2580	75f5ee0f94c3a0e869cff827578bb540_NeikiAnalytics.exe	83
PID 2580 wrote to memory of 1504	2580	75f5ee0f94c3a0e869cff827578bb540_NeikiAnalytics.exe	83
PID 2580 wrote to memory of 1504	2580	75f5ee0f94c3a0e869cff827578bb540_NeikiAnalytics.exe	83
PID 1504 wrote to memory of 5116	1504	cmd.exe	84
PID 1504 wrote to memory of 5116	1504	cmd.exe	84
PID 1504 wrote to memory of 5116	1504	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\75f5ee0f94c3a0e869cff827578bb540_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\75f5ee0f94c3a0e869cff827578bb540_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:5116

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
a8c2a967801246b72e87e823cdebe758

SHA1
2de36df2ef74465b5a7d1a9831f25e6472b21fb0

SHA256
532481643f3d7fe18f5e4357e2cffcef56dddbf2e1caf8a53e51330f0e20923e

SHA512
38babf0b9cbb105b630b67b833cbe06d771552fca2ef153ddabf83f0961633c2830c23b5e4c9846ee6c2bc471cfde620723e49013d4e0a6470fb496ddf9c7a3a

Download Submit
memory/2580-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5116-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download