328a6cba789f7e20d43cbaa605ca1fe40c7ff327d23ea03ef325ae6bd5d57cf9

Analysis

max time kernel
129s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 01:05

Target
72cc69210ae29d700cf9a89613310700_NeikiAnalytics.exe
Size 4.4MB
Sample240517-bfvzlsac3w
SHA256 328a6cba789f7e20d43cbaa605ca1fe40c7ff327d23ea03ef325ae6bd5d57cf9
MD5 72cc69210ae29d700cf9a89613310700
SHA1 460391b4e43f7a5019ed783282ddcb68525d806a
SHA512 a6bd8142f81b78e5185066459db514542e82dff7f67bd2527ee05d6031cc91055cd2a9c1c6f103ce76bddb81731301c1ba0f41a64ef54e3e43d6a21d2a81ddfc
SSDEEP 98304:emhd1UryewT+K9/9FCp0nVV7wQqZUha5jtSn:els+KJlV2QbaZte
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3196	4DE1.tmp

Executes dropped EXE 1 IoCs

pid	Process
3196	4DE1.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 3196	2548	72cc69210ae29d700cf9a89613310700_NeikiAnalytics.exe	82
PID 2548 wrote to memory of 3196	2548	72cc69210ae29d700cf9a89613310700_NeikiAnalytics.exe	82
PID 2548 wrote to memory of 3196	2548	72cc69210ae29d700cf9a89613310700_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\72cc69210ae29d700cf9a89613310700_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\72cc69210ae29d700cf9a89613310700_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Users\Admin\AppData\Local\Temp\4DE1.tmp
  "C:\Users\Admin\AppData\Local\Temp\4DE1.tmp" --splashC:\Users\Admin\AppData\Local\Temp\72cc69210ae29d700cf9a89613310700_NeikiAnalytics.exe 3E81480316C71A545BF70AF39A30D9C296E81C25E1E0B70F84944AA1A79F54362B1EC4143F37E7095C84B9F654FDB804A7A09195F358D6CF38EA84D0F4EE3A09
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3196

4DE1.tmp

Path C:\Users\Admin\AppData\Local\Temp\4DE1.tmp
Size 4.4MB
SHA256 45e83a81ed9e4f7f99d6ec5a93b94d5ef06a232d7818d45f3b55cdb61c67576a
MD5 b12bdab2bce48c7da0d7da16bb7c856d
SHA1 f47ffe1886392e4052e7d2921cabb475a53b6e35
SHA512 4d85127554c3dbbed182a8081fc853d1ce7d7360abc1b1ea342d4d5d3c9a1e63692bdab48422c5f02a6d32c3052af711e7db8be544494bb16b41ec57df0f5947
SSDEEP 98304:emhd1Urye6VRx/fwjLBgBV7wQqZUha5jtSn:elaBGLq2QbaZte
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2548-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/3196-5-0x0000000000400000-0x0000000000849000-memory.dmp

Download