ac94e429bb833acff84dad6d8420ac6c96258063cc991151de7bb157a76a4258

Analysis

max time kernel
92s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 17:38

Target
192a5d118cf28720b8ae986b02586eb0_NeikiAnalytics.exe
Size 79KB
Sample240526-v778ssfb24
SHA256 ac94e429bb833acff84dad6d8420ac6c96258063cc991151de7bb157a76a4258
MD5 192a5d118cf28720b8ae986b02586eb0
SHA1 4a103060072cd58fc4572399736d78d42c7b05a9
SHA512 2aeb3bce003d861d39c8e491535032cdb3b0a8f7803b1e275a8c7de6c251cf2adfef0f7bb8d1761d7e9444a133ab416cbbde41d603b043f3dd8494810a45b711
SSDEEP 1536:zvwTPCyl/fKNwOQA8AkqUhMb2nuy5wgIP0CSJ+5y3mB8GMGlZ5G:zvwj1l/fKNlGdqU7uy5w9WMyWN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
5020	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 4456	432	192a5d118cf28720b8ae986b02586eb0_NeikiAnalytics.exe	87
PID 432 wrote to memory of 4456	432	192a5d118cf28720b8ae986b02586eb0_NeikiAnalytics.exe	87
PID 432 wrote to memory of 4456	432	192a5d118cf28720b8ae986b02586eb0_NeikiAnalytics.exe	87
PID 4456 wrote to memory of 5020	4456	cmd.exe	88
PID 4456 wrote to memory of 5020	4456	cmd.exe	88
PID 4456 wrote to memory of 5020	4456	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\192a5d118cf28720b8ae986b02586eb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\192a5d118cf28720b8ae986b02586eb0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:5020

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 8d0b200d1ebe7ff851b94a72ff84cc0c0678a3e9c0fbc672868a0815ed6badd1
MD5 b93db27fe6a1620d227b9943a5fee8ab
SHA1 0ca96effd6a09423083698659092e332fdccd09a
SHA512 b6e8ce1746e6077c004cf7f07c90dc72ce059322c250584d24cdf7fa87514c44a8b99714d1b8b475900f9dc5355b8afae6d9e4b0849ffc945a4322ba15e6499e
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5yfmB8GMGlZ5G:zv+vTpGdqU7uy5w9WMyON5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/432-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5020-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download