78cf52258f2a1a4168f783e987e62b1cfe438e198c0dc2c96064940a4d5230ca

Analysis

max time kernel
132s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 03:12

Target
59956b6f95449a7ebd6b079eec0b8fd0_NeikiAnalytics.exe
Size 73KB
Sample240526-dql6kade78
SHA256 78cf52258f2a1a4168f783e987e62b1cfe438e198c0dc2c96064940a4d5230ca
MD5 59956b6f95449a7ebd6b079eec0b8fd0
SHA1 5f5f9a51be5c997385d10291d67d965d4fbdb372
SHA512 c52a9fc492d3eb87f59ad00941fd7c4e29d29d90b92ba8aa6b3f73d07d8c1282bf2b21ea0dedf8acdd8fe337c37453d29bd64eb6b3449a59153c1a525cdf4513
SSDEEP 1536:hbenS1B1lQd4K5QPqfhVWbdsmA+RjPFLC+e5hBT0ZGUGf2g:hCSL1lQiNPqfcxA+HFshBTOg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2844	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 4844	4300	59956b6f95449a7ebd6b079eec0b8fd0_NeikiAnalytics.exe	84
PID 4300 wrote to memory of 4844	4300	59956b6f95449a7ebd6b079eec0b8fd0_NeikiAnalytics.exe	84
PID 4300 wrote to memory of 4844	4300	59956b6f95449a7ebd6b079eec0b8fd0_NeikiAnalytics.exe	84
PID 4844 wrote to memory of 2844	4844	cmd.exe	85
PID 4844 wrote to memory of 2844	4844	cmd.exe	85
PID 4844 wrote to memory of 2844	4844	cmd.exe	85
PID 2844 wrote to memory of 2936	2844	[email protected]	86
PID 2844 wrote to memory of 2936	2844	[email protected]	86
PID 2844 wrote to memory of 2936	2844	[email protected]	86

C:\Users\Admin\AppData\Local\Temp\59956b6f95449a7ebd6b079eec0b8fd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\59956b6f95449a7ebd6b079eec0b8fd0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2844
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2936

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 73KB
SHA256 7f36476da35be169433f8e1cfd525b1bcea6dbb694d1c876ca41ade78918e5fe
MD5 04bb2bb72a4a318f26d7169db3f35bc6
SHA1 b4e5fe1bf912388c6fd07e9d92d892d4662d366a
SHA512 e4835ad5fc51ca094bf459784e0f947dccc09c41a27863778457dd429c9190ed8bfe98761e764ef1a0fa0a54b5878fa9d903ddcd7f16969af7b8610ef35fae24
SSDEEP 1536:hbSYv9ZK5QPqfhVWbdsmA+RjPFLC+e5hZT0ZGUGf2g:hGYvHNPqfcxA+HFshZTOg
MD5 SHA1 SHA512 SSDEEP

Submit Download

00.exe

Path C:\Users\Admin\AppData\Local\Temp\00.exe
Size 2KB
SHA256 bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991
MD5 7b621943a35e7f39cf89f50cc48d7b94
SHA1 2858a28cf60f38025fffcd0ba2ecfec8511c197d
SHA512 4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1
MD5 SHA1 SHA512

Submit Download

memory/2844-7-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/4300-8-0x0000000000400000-0x0000000000419000-memory.dmp

Download