2b5597f915a27461039c741e5640340fd9a483866ea13ebc00baafc346144abc

Analysis

max time kernel
51s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 00:02

Target

91f7b584ebca97a0f989f574273fbbf0_NeikiAnalytics.exe
Size

7.8MB
MD5

91f7b584ebca97a0f989f574273fbbf0
SHA1

47cc8bf5fe9047217893dcf0b141e5c8f6063eb5
SHA256

2b5597f915a27461039c741e5640340fd9a483866ea13ebc00baafc346144abc
SHA512

5065aa325221f6c1f9dc57c631b77198ec530706edb6e20f2cfaab3c83f40faa7c502a2cc371fa1312dd7aa274b21ee1e35e3b76c93192ecf8e4641ce88e3d3d
SSDEEP

98304:emhd1UryeWHaQjbX6Im0uSNV7wQqZUha5jtSyZIUb:el2HaQiDSN2QbaZtli

Score

7^/10

Deletes itself 1 IoCs

pid	Process
696	51F8.tmp

Executes dropped EXE 1 IoCs

pid	Process
696	51F8.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 696	4160	91f7b584ebca97a0f989f574273fbbf0_NeikiAnalytics.exe	85
PID 4160 wrote to memory of 696	4160	91f7b584ebca97a0f989f574273fbbf0_NeikiAnalytics.exe	85
PID 4160 wrote to memory of 696	4160	91f7b584ebca97a0f989f574273fbbf0_NeikiAnalytics.exe	85

C:\Users\Admin\AppData\Local\Temp\91f7b584ebca97a0f989f574273fbbf0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\91f7b584ebca97a0f989f574273fbbf0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Users\Admin\AppData\Local\Temp\51F8.tmp
  "C:\Users\Admin\AppData\Local\Temp\51F8.tmp" --splashC:\Users\Admin\AppData\Local\Temp\91f7b584ebca97a0f989f574273fbbf0_NeikiAnalytics.exe 4360E487DC3AED1321976EAC3D6081DC545F92BE0151E123FACAC1789FE502FFDB2C5898A417960717DEF5E9E5DA6F5925D28FD347F2BE525BA014FF337CC16D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:696

C:\Users\Admin\AppData\Local\Temp\51F8.tmp

Filesize
7.8MB

MD5
3c9e612fe814c7045cbcb7e35b0aa994

SHA1
1d54462b8a64039c65e00315a8c68441acf50e86

SHA256
f564e84ad5ee8f7bccda6ad823947a67355063afbf641be0ccf1cf88e0d11829

SHA512
8d68aceb79e42cf0a9cac8a083693c79d53c147b84ac0f08b94ee2d519fe61e72ef65fe6263c929d53828171eadcb60aa926576e832702904925d50749e8bc5b

Download Submit
memory/696-5-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download
memory/4160-0-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download