6f52035bd901922b4713eaa74ac9ac9fa0315e444dac0d0e2bcfd5735b81dd66

Analysis

max time kernel
92s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 01:08

Target
3797747be7d78b073a4ad79a90d8cc80_NeikiAnalytics.exe
Size 79KB
Sample240510-bhd4wadb43
SHA256 6f52035bd901922b4713eaa74ac9ac9fa0315e444dac0d0e2bcfd5735b81dd66
MD5 3797747be7d78b073a4ad79a90d8cc80
SHA1 3f30bc23a8dade46cdf5c1d35d88c600901b5136
SHA512 7e74d7bc33e84b32192c3254a465c4fa64b0e11c556cae2a104c2bc89583e044fbd40386725abb493102ee6fb4e79b177ce4318ecc9d27a53dd803d8265cb3cb
SSDEEP 1536:zv6fdjP2uMHZAOQA8AkqUhMb2nuy5wgIP0CSJ+5yHB8GMGlZ5G:zv652PjGdqU7uy5w9WMyHN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3416	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1492	1768	3797747be7d78b073a4ad79a90d8cc80_NeikiAnalytics.exe	83
PID 1768 wrote to memory of 1492	1768	3797747be7d78b073a4ad79a90d8cc80_NeikiAnalytics.exe	83
PID 1768 wrote to memory of 1492	1768	3797747be7d78b073a4ad79a90d8cc80_NeikiAnalytics.exe	83
PID 1492 wrote to memory of 3416	1492	cmd.exe	84
PID 1492 wrote to memory of 3416	1492	cmd.exe	84
PID 1492 wrote to memory of 3416	1492	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\3797747be7d78b073a4ad79a90d8cc80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3797747be7d78b073a4ad79a90d8cc80_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:3416

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 10cda9ab087b7e77327b489536d46845331bd268c4dc74a81403a22d72b856b1
MD5 249f560ae406cf4c96ae957e8f504d76
SHA1 f4cb99a58f2f27ad67df65d7eaa5ad8e4e19e237
SHA512 a5b3276f8deb193af04b565b9354548e3d54f396281d322fe0365ca0df139edfc8fab585479b3bf8755ed0e77540c4f62c107f052a829f0903722dc39969dfa3
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5yhB8GMGlZ5G:zv+vTpGdqU7uy5w9WMyhN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1768-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3416-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download