590ed06e118745df87f4622e353a873ad8f15762023ce0fdb30151057b41c0b5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 10:44

Target
0d2bc94ac29e853724c593a23a565330_NeikiAnalytics.exe
Size 79KB
Sample240526-mtardagc35
SHA256 590ed06e118745df87f4622e353a873ad8f15762023ce0fdb30151057b41c0b5
MD5 0d2bc94ac29e853724c593a23a565330
SHA1 0f6c938ce937827e7878062af22e186d89cc7c6e
SHA512 9984df3ac096a18dc4e0d5e1a5a38973e202c80fd07e03cd7953dab20d6898b9e1ea17344df385fb3b0f7f0d43e2a161a89873872a1797d2826e25c2c06781f4
SSDEEP 1536:zvESC2WTJJIMqKoOQA8AkqUhMb2nuy5wgIP0CSJ+5yqB8GMGlZ5G:zvE0WTJJ0KtGdqU7uy5w9WMyqN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1972	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 1644	2896	0d2bc94ac29e853724c593a23a565330_NeikiAnalytics.exe	84
PID 2896 wrote to memory of 1644	2896	0d2bc94ac29e853724c593a23a565330_NeikiAnalytics.exe	84
PID 2896 wrote to memory of 1644	2896	0d2bc94ac29e853724c593a23a565330_NeikiAnalytics.exe	84
PID 1644 wrote to memory of 1972	1644	cmd.exe	85
PID 1644 wrote to memory of 1972	1644	cmd.exe	85
PID 1644 wrote to memory of 1972	1644	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\0d2bc94ac29e853724c593a23a565330_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0d2bc94ac29e853724c593a23a565330_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:1972

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 92ecf59e97cf00c10e624b1fedaa650f0eb5163c2cfd6d3e3de3e43fea78c678
MD5 55aa36e71901c961e81fa096c482bf01
SHA1 2904438fbe392ab463b0665fe07d438316a46624
SHA512 2230b2fce8ca219c86a6e7efba3f2b8fdec67362e48ecc5fc4348e342acd74fd2c7360573ac5e8d4ad0b527ce255f0dbfe5fde681dea0c91309c491984a9f0b0
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5yaB8GMGlZ5G:zv+vTpGdqU7uy5w9WMyaN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1972-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2896-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download