6643acfa1237229247d97c486cc88d19ce36af4e60db0c25b852eb5fa0c35832

Analysis

max time kernel
134s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 12:23

Target
249daadc3e6ecddf98054415cc182c00_NeikiAnalytics.exe
Size 79KB
Sample240526-pkrpmsch47
SHA256 6643acfa1237229247d97c486cc88d19ce36af4e60db0c25b852eb5fa0c35832
MD5 249daadc3e6ecddf98054415cc182c00
SHA1 90ef451dace40dc20c1c4799470b0af8e6419597
SHA512 15311e1b9ff424a05be3e9242991318dc56fdbf8484681edd47c9cbdd44f4f3a0228ae0aa6ca41c8adf6a95b750229671e9439989fdba3f91d1f8ba434de22dc
SSDEEP 1536:zvuE77Aou+e+OQA8AkqUhMb2nuy5wgIP0CSJ+5ygB8GMGlZ5G:zvuE7c+MGdqU7uy5w9WMygN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
5000	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 3472	652	249daadc3e6ecddf98054415cc182c00_NeikiAnalytics.exe	84
PID 652 wrote to memory of 3472	652	249daadc3e6ecddf98054415cc182c00_NeikiAnalytics.exe	84
PID 652 wrote to memory of 3472	652	249daadc3e6ecddf98054415cc182c00_NeikiAnalytics.exe	84
PID 3472 wrote to memory of 5000	3472	cmd.exe	85
PID 3472 wrote to memory of 5000	3472	cmd.exe	85
PID 3472 wrote to memory of 5000	3472	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\249daadc3e6ecddf98054415cc182c00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\249daadc3e6ecddf98054415cc182c00_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:5000

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 c27d01f1929762bb2568c090c43e774ca5594a1ea5a6e48104b85ecd11103e04
MD5 e91d33b5fd44ab8eba6d89595bb94553
SHA1 a7017b3bcec67bfb9531ddbf06b3ef89a2262f76
SHA512 97e24090441cb5d98cbc54fe5a89e33525cbc2113cd6517f5232360bb537588673c3f199d81cb625f9d634b24a08e575bdd18f0355b67b3e244e7ae12a2b0825
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5yMB8GMGlZ5G:zv+vTpGdqU7uy5w9WMyMN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/652-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5000-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download