a0a0bb2fb46877b742caa3835bc452a6318c0aefa29d69285ba5b20950b1018a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 19:11

Target
0f8f5d223b571722742d5658aacb8000_NeikiAnalytics.exe
Size 73KB
Sample240527-xwbfssfg63
SHA256 a0a0bb2fb46877b742caa3835bc452a6318c0aefa29d69285ba5b20950b1018a
MD5 0f8f5d223b571722742d5658aacb8000
SHA1 daadf412949e84eb646f440057003e67590f4aa7
SHA512 1047c36a30388642b93acffc9fe518acf5fc2571e98122b782b7ab083b54a517966604e0dc3fdeca46b2c156b1ce16bb36736be48150faf39ed084b9f13634e4
SSDEEP 1536:hbe2f0xXOeK5QPqfhVWbdsmA+RjPFLC+e5hf0ZGUGf2g:hH0hbNPqfcxA+HFshfOg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4648	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 4048	4440	0f8f5d223b571722742d5658aacb8000_NeikiAnalytics.exe	83
PID 4440 wrote to memory of 4048	4440	0f8f5d223b571722742d5658aacb8000_NeikiAnalytics.exe	83
PID 4440 wrote to memory of 4048	4440	0f8f5d223b571722742d5658aacb8000_NeikiAnalytics.exe	83
PID 4048 wrote to memory of 4648	4048	cmd.exe	84
PID 4048 wrote to memory of 4648	4048	cmd.exe	84
PID 4048 wrote to memory of 4648	4048	cmd.exe	84
PID 4648 wrote to memory of 1520	4648	[email protected]	85
PID 4648 wrote to memory of 1520	4648	[email protected]	85
PID 4648 wrote to memory of 1520	4648	[email protected]	85

C:\Users\Admin\AppData\Local\Temp\0f8f5d223b571722742d5658aacb8000_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0f8f5d223b571722742d5658aacb8000_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4648
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:1520

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 73KB
SHA256 6910427ffb0601dd5b358030924557ad634664d5a85a5cbe4ea3a05ee58c66cf
MD5 447be3a4964b395854bb0639b9ef8bed
SHA1 cfc429598291a4b47d79d37492858b02e83a4d1e
SHA512 98fc87c629de576e0618c65d2c8d5ad0662b93032a11ac09abda0a3b34604c43f4e83e84ae224e15a76dc27d4c178c67a2a2f9aca28027a687af26c0702cfe40
SSDEEP 1536:hbSYv9ZK5QPqfhVWbdsmA+RjPFLC+e5hP0ZGUGf2g:hGYvHNPqfcxA+HFshPOg
MD5 SHA1 SHA512 SSDEEP

Submit Download

00.exe

Path C:\Users\Admin\AppData\Local\Temp\00.exe
Size 2KB
SHA256 bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991
MD5 7b621943a35e7f39cf89f50cc48d7b94
SHA1 2858a28cf60f38025fffcd0ba2ecfec8511c197d
SHA512 4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1
MD5 SHA1 SHA512

Submit Download

memory/4440-8-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/4648-7-0x0000000000400000-0x0000000000419000-memory.dmp

Download