6a79458c810f45d3071b2314b7a47ce86016736551a898152e2c1a87549b9bfc

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2024 02:06

Target

97b97fa0ec4048598df54e5b2d924e20_NeikiAnalytics.exe
Size

4.2MB
MD5

97b97fa0ec4048598df54e5b2d924e20
SHA1

0c07bc05cd6eb980f8c0b774910187d3bc143947
SHA256

6a79458c810f45d3071b2314b7a47ce86016736551a898152e2c1a87549b9bfc
SHA512

f377f5eb032ad9115eab7faa98d3b8a8f7446fee0cdd2955555742495c88e4708af81e83312d50448658ccf28d09acae5b963010ccc1ad261628ff5b22f87ff8
SSDEEP

98304:Cmhd1Uryek5W8kphWj8vIJtsVLUjH5oxFbxhVLUjH5oxFbx:ClEoFgtsVUjZEdhVUjZEd

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4852	5023.tmp

Executes dropped EXE 1 IoCs

pid	Process
4852	5023.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 4852	4832	97b97fa0ec4048598df54e5b2d924e20_NeikiAnalytics.exe	84
PID 4832 wrote to memory of 4852	4832	97b97fa0ec4048598df54e5b2d924e20_NeikiAnalytics.exe	84
PID 4832 wrote to memory of 4852	4832	97b97fa0ec4048598df54e5b2d924e20_NeikiAnalytics.exe	84

C:\Users\Admin\AppData\Local\Temp\97b97fa0ec4048598df54e5b2d924e20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\97b97fa0ec4048598df54e5b2d924e20_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Users\Admin\AppData\Local\Temp\5023.tmp
  "C:\Users\Admin\AppData\Local\Temp\5023.tmp" --splashC:\Users\Admin\AppData\Local\Temp\97b97fa0ec4048598df54e5b2d924e20_NeikiAnalytics.exe 691861AD79BD3BE17BD6FE5949ECEF2EE6F6659ADA16C136B1141EE7F36421FFE1840303216411AEB574D28B49371F2C3B2CAFEA1CBC4FD852D42010458F352E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4852

C:\Users\Admin\AppData\Local\Temp\5023.tmp

Filesize
4.2MB

MD5
0b1a52deaee09081cb0dacd10fa4652f

SHA1
ed4dabe2f5b7eb73c114ea208f06a17a539a101a

SHA256
1ab008bbfb0d4e052b9101a28829fa2a624e5d6814d473a521c9868907113cf5

SHA512
4706d2277ddddc80350368d3544749d1ac1a1247f9edaeb16d36e318cded9460882e93196113b4ab8b537c2e3775ab175a127ac984adf065c5b74731468bba91

Download Submit
memory/4832-0-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download
memory/4852-5-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download