304da66bdb5881793a5a87edd834e5dfcd807deaa894ac8f2cae35333f101fe8

Analysis

max time kernel
51s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 22:34

Target

304da66bdb5881793a5a87edd834e5dfcd807deaa894ac8f2cae35333f101fe8_NeikiAnalytics.exe
Size

73KB
MD5

876ba76ce5052d1576df51ff786afbb0
SHA1

96b6d1a919831d80632457ec2413fc973364e449
SHA256

304da66bdb5881793a5a87edd834e5dfcd807deaa894ac8f2cae35333f101fe8
SHA512

d0af9ed83b48fae4e70537d03aad2dca7fc78c452dd94c944f90abbb5ec234fb39c41553c1d0f4b2b8b4e6a1672dba4da6a82b35616399b680d3ff240b3a2f28
SSDEEP

1536:hbpCUCU608K5QPqfhVWbdsmA+RjPFLC+e5hX0ZGUGf2g:hlCUCX08NPqfcxA+HFshXOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2740	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 212	1548	304da66bdb5881793a5a87edd834e5dfcd807deaa894ac8f2cae35333f101fe8_NeikiAnalytics.exe	81
PID 1548 wrote to memory of 212	1548	304da66bdb5881793a5a87edd834e5dfcd807deaa894ac8f2cae35333f101fe8_NeikiAnalytics.exe	81
PID 1548 wrote to memory of 212	1548	304da66bdb5881793a5a87edd834e5dfcd807deaa894ac8f2cae35333f101fe8_NeikiAnalytics.exe	81
PID 212 wrote to memory of 2740	212	cmd.exe	82
PID 212 wrote to memory of 2740	212	cmd.exe	82
PID 212 wrote to memory of 2740	212	cmd.exe	82
PID 2740 wrote to memory of 4936	2740	[email protected]	83
PID 2740 wrote to memory of 4936	2740	[email protected]	83
PID 2740 wrote to memory of 4936	2740	[email protected]	83

C:\Users\Admin\AppData\Local\Temp\304da66bdb5881793a5a87edd834e5dfcd807deaa894ac8f2cae35333f101fe8_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\304da66bdb5881793a5a87edd834e5dfcd807deaa894ac8f2cae35333f101fe8_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:4936

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
688acb4f7732078d92585d48719cf569

SHA1
174ce9e22f17f28db675cba5ed39099a0eb6fe52

SHA256
2a937a8d2e157924cb5cd08c2ed157cb5ff182e6abe60be5f6af5a59a52bbfb1

SHA512
cf71d7b3b6436a44e32c5c56802088aae32cf4f10c2ca4b74384b0d4c75db17badacdc805016edc9f0af1253e5008ba81b0447d5fd2283960bf82f1d82a6e56e

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/1548-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2740-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download