0d79b3dada74bab0134f04469f92cc750f916d9d5200bb7bb518133a2a54d23b

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 02:31

Target

8a1a515406545c253cd616598744bc60_NeikiAnalytics.exe
Size

79KB
MD5

8a1a515406545c253cd616598744bc60
SHA1

72b98b00112a696b750bf8c5826db0aec283abd5
SHA256

0d79b3dada74bab0134f04469f92cc750f916d9d5200bb7bb518133a2a54d23b
SHA512

3414a2cb18119773f208cc462747388070d531668992ec47f7ed0c7a1e4112c2ddeb9e88ed618ff6035fb16597cc6fae7a6ae355f6ec3e49cc947e69cd70bce2
SSDEEP

1536:zvLdkuNQXgNOqcQqfgOQA8AkqUhMb2nuy5wgIP0CSJ+5yBB8GMGlZ5G:zvJ16/Ia1GdqU7uy5w9WMyBN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1560	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 1344	4580	8a1a515406545c253cd616598744bc60_NeikiAnalytics.exe	82
PID 4580 wrote to memory of 1344	4580	8a1a515406545c253cd616598744bc60_NeikiAnalytics.exe	82
PID 4580 wrote to memory of 1344	4580	8a1a515406545c253cd616598744bc60_NeikiAnalytics.exe	82
PID 1344 wrote to memory of 1560	1344	cmd.exe	83
PID 1344 wrote to memory of 1560	1344	cmd.exe	83
PID 1344 wrote to memory of 1560	1344	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\8a1a515406545c253cd616598744bc60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8a1a515406545c253cd616598744bc60_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:1560

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
39ef33b2cad293e3f05f290a19b1ed7d

SHA1
48bca5f43f55a68c0bc832d1fb83b94abca98331

SHA256
1a7d62207e65f2935d2641b63424e4f718b4514af2d1106fc0cc0c0b9efb6224

SHA512
a0a4fd41ee739a440ba470c71a4c3ae2d775bea3983f71eb1fbd56fd6171a10be003f66279ab31ea1c6729483062a9259b5fc0f0029d3da1bd2018e22d916792

Download Submit
memory/1560-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4580-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download