c0863ef3f6007c4b1ca7804e035f9662b658c71101972580a32a71a6680e6a14

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 22:06

Target
0d66e1adf742c0247f93c4f0f7977b40_NeikiAnalytics.exe
Size 79KB
Sample240528-11aa3sec6t
SHA256 c0863ef3f6007c4b1ca7804e035f9662b658c71101972580a32a71a6680e6a14
MD5 0d66e1adf742c0247f93c4f0f7977b40
SHA1 c9b79fbea6b3be1d28f747ae71f59d5a528e881a
SHA512 85263faf1be6537f402853e5842cbd13cd189f645012f80b5c244127e732d2f817305726eee313dcbf4d988e46bd66e6e647df1a14db69c14888962ac7ff0736
SSDEEP 1536:zvdtbD/STEiCoOQA8AkqUhMb2nuy5wgIP0CSJ+5ykB8GMGlZ5G:zvdtPS7CtGdqU7uy5w9WMykN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2260	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 3580	3948	0d66e1adf742c0247f93c4f0f7977b40_NeikiAnalytics.exe	84
PID 3948 wrote to memory of 3580	3948	0d66e1adf742c0247f93c4f0f7977b40_NeikiAnalytics.exe	84
PID 3948 wrote to memory of 3580	3948	0d66e1adf742c0247f93c4f0f7977b40_NeikiAnalytics.exe	84
PID 3580 wrote to memory of 2260	3580	cmd.exe	85
PID 3580 wrote to memory of 2260	3580	cmd.exe	85
PID 3580 wrote to memory of 2260	3580	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\0d66e1adf742c0247f93c4f0f7977b40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0d66e1adf742c0247f93c4f0f7977b40_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2260

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 8b9b1a256fdd0b2fe4839ef3d435c35b41e7295dceb7d4f82c47c638808bbdaf
MD5 d5a7132a14b633b2cd5fc6817037eee5
SHA1 6ff603ca1e6a50417736bca96770e20ae8e0d3dc
SHA512 ad2dc3ef55611fb3cbe1d0d03d47688bd39f9a1ad1920c8be92e0840768da9dd9f555b597a6b1932fb4aa18de8b51c837f812a02dd428d932b55b126871a4ae2
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5yIB8GMGlZ5G:zv+vTpGdqU7uy5w9WMyIN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2260-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3948-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download