00046f5896b5c20b9e357359b03e379e93ced460aed9ebe5f6b49faa0b0c65dc

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 01:51

Target

9754167ab12afd90090c321831ce8680_NeikiAnalytics.exe
Size

73KB
MD5

9754167ab12afd90090c321831ce8680
SHA1

d66975066fd8c0c2e69b1d6b57051a360e58df25
SHA256

00046f5896b5c20b9e357359b03e379e93ced460aed9ebe5f6b49faa0b0c65dc
SHA512

b6a46fd7a1514c820fd65dadf5c576b92b1243fbdfb67838b4ebac357f800c2911ec730948ebeac7f66afb90a75671d5283dbe1e01dd0180df77d0a57d6503a4
SSDEEP

1536:hbpe+jSbp8k0zvrWK5QPqfhVWbdsmA+RjPFLC+e5hJ0ZGUGf2g:hTjIEnWNPqfcxA+HFshJOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4688	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 1136	1436	9754167ab12afd90090c321831ce8680_NeikiAnalytics.exe	84
PID 1436 wrote to memory of 1136	1436	9754167ab12afd90090c321831ce8680_NeikiAnalytics.exe	84
PID 1436 wrote to memory of 1136	1436	9754167ab12afd90090c321831ce8680_NeikiAnalytics.exe	84
PID 1136 wrote to memory of 4688	1136	cmd.exe	85
PID 1136 wrote to memory of 4688	1136	cmd.exe	85
PID 1136 wrote to memory of 4688	1136	cmd.exe	85
PID 4688 wrote to memory of 3024	4688	[email protected]	86
PID 4688 wrote to memory of 3024	4688	[email protected]	86
PID 4688 wrote to memory of 3024	4688	[email protected]	86

C:\Users\Admin\AppData\Local\Temp\9754167ab12afd90090c321831ce8680_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9754167ab12afd90090c321831ce8680_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4688
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:3024

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
0f091ed8dd3891e4c5c6a0d00484bb4f

SHA1
5ddf2634f505c7a9dc9d1e50ca469a689f333ff4

SHA256
280e5cda95dcb46e39cbdc2352ef6f8f4342ee47a3a84fee3347938c60a75bfb

SHA512
b30ed0992c42ca9dda13a7d703463cab6ebde9e5497c2c89c995e63ad04fc9f98917a596d39ac3b658222940a54d4caac86eda4ac725a9b0dd401bd17ac57308

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/1436-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4688-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download