04ab4dd22aed1a4447fdbe4eaf975b41fd259764286b3ddc7a5a05f483275770

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 15:27

Target

04ab4dd22aed1a4447fdbe4eaf975b41fd259764286b3ddc7a5a05f483275770_NeikiAnalytics.exe
Size

7.0MB
MD5

5723972585e13fd3ca9153e791c24f40
SHA1

e11a2b6d5195a2473162224a8417873767354f37
SHA256

04ab4dd22aed1a4447fdbe4eaf975b41fd259764286b3ddc7a5a05f483275770
SHA512

76bb1fd73343c213683c510e001b3aad2b0beb6f5ac53bcafe061046d15469e21f99bc5dc6de7967ad08b74bba89f28c8a9c6f23e101e1aa8b0dadb0cc2030d6
SSDEEP

98304:emhd1Urye2dP37o1OGgdjV7wQqZUha5jtSyZIUbn:elWteHgdj2QbaZtliK

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2300	4AC4.tmp

Executes dropped EXE 1 IoCs

pid	Process
2300	4AC4.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 2300	1460	04ab4dd22aed1a4447fdbe4eaf975b41fd259764286b3ddc7a5a05f483275770_NeikiAnalytics.exe	80
PID 1460 wrote to memory of 2300	1460	04ab4dd22aed1a4447fdbe4eaf975b41fd259764286b3ddc7a5a05f483275770_NeikiAnalytics.exe	80
PID 1460 wrote to memory of 2300	1460	04ab4dd22aed1a4447fdbe4eaf975b41fd259764286b3ddc7a5a05f483275770_NeikiAnalytics.exe	80

C:\Users\Admin\AppData\Local\Temp\04ab4dd22aed1a4447fdbe4eaf975b41fd259764286b3ddc7a5a05f483275770_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\04ab4dd22aed1a4447fdbe4eaf975b41fd259764286b3ddc7a5a05f483275770_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Users\Admin\AppData\Local\Temp\4AC4.tmp
  "C:\Users\Admin\AppData\Local\Temp\4AC4.tmp" --splashC:\Users\Admin\AppData\Local\Temp\04ab4dd22aed1a4447fdbe4eaf975b41fd259764286b3ddc7a5a05f483275770_NeikiAnalytics.exe BB71683A4550C076A1551D6C04404394D6636744E15C073A6371448590F060E3F9C732EAA2A045CA570F3F484CD4C09907EB391292E23BDC4C7C2AD842429DC8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2300

C:\Users\Admin\AppData\Local\Temp\4AC4.tmp

Filesize
7.0MB

MD5
c974415e8d1e3b924e77891397b9df64

SHA1
a641ce2b7e5a9714a24f0a37eab9ece861914ac9

SHA256
d9782429544921ee494e1c4672be54ec105c2acb50ebdf44079ed4ec3af1604a

SHA512
177ff6be965989581ffafe2d65aa77d50f3246cf037747a6b07caffcbaf32e4ef8e76485bcd28969f28b6ab7a8c9eb947b3df9d7e45ef8b821e247a9f6cdb951

Download Submit
memory/1460-0-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download
memory/2300-5-0x0000000000400000-0x0000000000849000-memory.dmp

Filesize
4.3MB

Download