e57349764769b8f811455cea203b8697f16a15c6e96b5ec91c32a030e6a4058a

Analysis

max time kernel
92s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 12:07

Target
65af54af19b52331d48287ca5dc4bd00_NeikiAnalytics.exe
Size 79KB
Sample240527-palewacc25
SHA256 e57349764769b8f811455cea203b8697f16a15c6e96b5ec91c32a030e6a4058a
MD5 65af54af19b52331d48287ca5dc4bd00
SHA1 f47e971173d0cf52a5b5ba441147d349a3bf4e56
SHA512 4b395778767f8fc13b53276f6825e17c29b01b5ca2e9e16941e84f0741adfc2374902e363c6813ce1e8a3a761bbd9c0f67bd789d8134c13ad7d9f7fd451d7545
SSDEEP 1536:zvOHUJ512ODMsKHVv1hOQA8AkqUhMb2nuy5wgIP0CSJ+5yTB8GMGlZ5G:zvOM2OD5KHViGdqU7uy5w9WMyTN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4744	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1460	536	65af54af19b52331d48287ca5dc4bd00_NeikiAnalytics.exe	83
PID 536 wrote to memory of 1460	536	65af54af19b52331d48287ca5dc4bd00_NeikiAnalytics.exe	83
PID 536 wrote to memory of 1460	536	65af54af19b52331d48287ca5dc4bd00_NeikiAnalytics.exe	83
PID 1460 wrote to memory of 4744	1460	cmd.exe	84
PID 1460 wrote to memory of 4744	1460	cmd.exe	84
PID 1460 wrote to memory of 4744	1460	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\65af54af19b52331d48287ca5dc4bd00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\65af54af19b52331d48287ca5dc4bd00_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:4744

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 29878af36a33756dfee07add83dca6c86601791ba9427c8298403d2b13570ab5
MD5 4c11159229d0681fc2ab471a3f135474
SHA1 d275d6b1701fc28e15cfd81bdd2737c425ff4870
SHA512 9b948b01f6b1fcdd5c632d5ebcc88e9deeff04d5620a434c48de187e2b74b4670ef87838b48e7f817bea51ce7ab920f36d5ff760df8e5b38966a7fad8d11a4d8
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5ynB8GMGlZ5G:zv+vTpGdqU7uy5w9WMynN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/536-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4744-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download