bd573d7cd55f0b7b0b04255b6d9dd61f17ee6bc0c63d94709e79be2aaf2bd70f

Analysis

max time kernel
133s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 12:09

Target
767646f68caf0ef76c0392d803d71f00_NeikiAnalytics.exe
Size 79KB
Sample240526-pbznwsbb2s
SHA256 bd573d7cd55f0b7b0b04255b6d9dd61f17ee6bc0c63d94709e79be2aaf2bd70f
MD5 767646f68caf0ef76c0392d803d71f00
SHA1 78e2662b5a1307ae4992aa8591a5a6c3a32a34e5
SHA512 8278141d1590ee17876cb7b81cd1b91fb145441e04ae091b97ff3460237c5508ec65ff5a962b07029b04cf742ce5859372a64e7813cc99956ec1944ead65008c
SSDEEP 1536:zvtWgNR4gnuf/mNv4OQA8AkqUhMb2nuy5wgIP0CSJ+5yUB8GMGlZ5G:zvtWgcBf+vdGdqU7uy5w9WMyUN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3980	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1112	1760	767646f68caf0ef76c0392d803d71f00_NeikiAnalytics.exe	84
PID 1760 wrote to memory of 1112	1760	767646f68caf0ef76c0392d803d71f00_NeikiAnalytics.exe	84
PID 1760 wrote to memory of 1112	1760	767646f68caf0ef76c0392d803d71f00_NeikiAnalytics.exe	84
PID 1112 wrote to memory of 3980	1112	cmd.exe	85
PID 1112 wrote to memory of 3980	1112	cmd.exe	85
PID 1112 wrote to memory of 3980	1112	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\767646f68caf0ef76c0392d803d71f00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\767646f68caf0ef76c0392d803d71f00_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:3980

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 6ca620d45fc8db32426f7428439ff1e293fcd49bd94e7fb15a0b002e50ba4f36
MD5 bb28ca0a06818f6371b6aa3a25eaec1e
SHA1 c744082ecf88ff9ba03e02bbe5b76f3a2a2057c6
SHA512 bb45a913b8ef6ca482d8f2c2c77a15dcdf2cf4c7a07640bd7e98e83e67667492f3604dff4dd66aab7cdc74556e82aea0d06ebd1861ce3f523ef78fede0a793e3
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5y+B8GMGlZ5G:zv+vTpGdqU7uy5w9WMy+N5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1760-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3980-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download