2a0c56811c68abb451ec1047f636f26a976b43deadc72caf7fe230503ddda711

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 01:06

Target
35ac462f89e8e7aa8ad0f6249027aed0_NeikiAnalytics.exe
Size 79KB
Sample240525-bga1tshd39
SHA256 2a0c56811c68abb451ec1047f636f26a976b43deadc72caf7fe230503ddda711
MD5 35ac462f89e8e7aa8ad0f6249027aed0
SHA1 4d81f2d7124df4599d5bfcb0b2ca18aeae16a51e
SHA512 8df8ab7a31df759bab9cb3053ddca9eac8cd856937604c929eaa6b2779fa02cc71694a8df225102d286ea6c258df090cba92d1cd8889ab45c602192a1b5a281c
SSDEEP 1536:zv66mWLYKn8V5JOQA8AkqUhMb2nuy5wgIP0CSJ+5yRB8GMGlZ5G:zv6PsoIGdqU7uy5w9WMyRN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4860	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 4264	2964	35ac462f89e8e7aa8ad0f6249027aed0_NeikiAnalytics.exe	84
PID 2964 wrote to memory of 4264	2964	35ac462f89e8e7aa8ad0f6249027aed0_NeikiAnalytics.exe	84
PID 2964 wrote to memory of 4264	2964	35ac462f89e8e7aa8ad0f6249027aed0_NeikiAnalytics.exe	84
PID 4264 wrote to memory of 4860	4264	cmd.exe	85
PID 4264 wrote to memory of 4860	4264	cmd.exe	85
PID 4264 wrote to memory of 4860	4264	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\35ac462f89e8e7aa8ad0f6249027aed0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\35ac462f89e8e7aa8ad0f6249027aed0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:4860

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 37374eabc1b11911da403b94ff114919454682bd1adfe78349b0bf78c4edeadc
MD5 77338e00c07622636b61f8e17ef6697f
SHA1 3f0ab69f24736719aca3d5292b9635c7bbe5e101
SHA512 dab6542f69e95c4453598de3be88911d4d64d4d12c823d323f5e7d61971e6d89984b998470b55b3263f67fd063e510a6ca3748014c66df76556b2cc29ef55df3
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5ydB8GMGlZ5G:zv+vTpGdqU7uy5w9WMydN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2964-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4860-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download