0e96d72deaaa64d0bd8a55089fd6b81d518df5a54d512668dd663c872b0b78a0

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2024, 13:46

Target

0e96d72deaaa64d0bd8a55089fd6b81d518df5a54d512668dd663c872b0b78a0_NeikiAnalytics.exe
Size

73KB
MD5

02c08d89af4648484ceef172af046f40
SHA1

90dfa313120d803e1d7070139812e22ab054d4ab
SHA256

0e96d72deaaa64d0bd8a55089fd6b81d518df5a54d512668dd663c872b0b78a0
SHA512

ca6afe12468033d2df81acffb90877c745396dc904f1ddf3719c3d285e7687d4958d9e12a2dbde2969aab893d31c1b7db66cfeaa212eb9004ee73c2230844ede
SSDEEP

1536:hbWXV21dWzmKK5QPqfhVWbdsmA+RjPFLC+e5hq0ZGUGf2g:h221eFNPqfcxA+HFshqOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4296	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2748	2852	0e96d72deaaa64d0bd8a55089fd6b81d518df5a54d512668dd663c872b0b78a0_NeikiAnalytics.exe	82
PID 2852 wrote to memory of 2748	2852	0e96d72deaaa64d0bd8a55089fd6b81d518df5a54d512668dd663c872b0b78a0_NeikiAnalytics.exe	82
PID 2852 wrote to memory of 2748	2852	0e96d72deaaa64d0bd8a55089fd6b81d518df5a54d512668dd663c872b0b78a0_NeikiAnalytics.exe	82
PID 2748 wrote to memory of 4296	2748	cmd.exe	83
PID 2748 wrote to memory of 4296	2748	cmd.exe	83
PID 2748 wrote to memory of 4296	2748	cmd.exe	83
PID 4296 wrote to memory of 2556	4296	[email protected]	84
PID 4296 wrote to memory of 2556	4296	[email protected]	84
PID 4296 wrote to memory of 2556	4296	[email protected]	84

C:\Users\Admin\AppData\Local\Temp\0e96d72deaaa64d0bd8a55089fd6b81d518df5a54d512668dd663c872b0b78a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0e96d72deaaa64d0bd8a55089fd6b81d518df5a54d512668dd663c872b0b78a0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4296
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2556

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
48b523b0e83de32fdb4ef6c75156ca7a

SHA1
6ba5c80278062470dc0b9049cbe6f83dbb2f6883

SHA256
30bc3cd322103f1d4060739e3e16b7409a6bd7245ae649b695d29a4560179531

SHA512
5b0d3361b54b3d8299aaa95e3fdb594d60e874099fdc36422a41545998586acd3839836b636ae433998642018d5c2bfc274f55abd569c149168a9915bfa11d2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/2852-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4296-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download