a49df1205b1cedffedf33feba7d908cb9ca08604edfcb7465aa71362a3ccdab9

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 22:06

Target
0d78e37e60cb0f1efa8271bb402ee550_NeikiAnalytics.exe
Size 79KB
Sample240528-11dcqsfe34
SHA256 a49df1205b1cedffedf33feba7d908cb9ca08604edfcb7465aa71362a3ccdab9
MD5 0d78e37e60cb0f1efa8271bb402ee550
SHA1 ad794b822d11473177b7ea38db8e04a9edab3fab
SHA512 20e3a234b33f4256ee7038820547db5dc2061bf1d1723cf0ee409578ad6b0b39f5dcb58cc0cc02b1096a9eeb9229785c30d32bf445ddbbe5a9e81c07dffc019d
SSDEEP 1536:zvANfA7voIfaFOQA8AkqUhMb2nuy5wgIP0CSJ+5yQB8GMGlZ5G:zvANfvi9GdqU7uy5w9WMyQN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3780	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 5004	996	0d78e37e60cb0f1efa8271bb402ee550_NeikiAnalytics.exe	83
PID 996 wrote to memory of 5004	996	0d78e37e60cb0f1efa8271bb402ee550_NeikiAnalytics.exe	83
PID 996 wrote to memory of 5004	996	0d78e37e60cb0f1efa8271bb402ee550_NeikiAnalytics.exe	83
PID 5004 wrote to memory of 3780	5004	cmd.exe	84
PID 5004 wrote to memory of 3780	5004	cmd.exe	84
PID 5004 wrote to memory of 3780	5004	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\0d78e37e60cb0f1efa8271bb402ee550_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0d78e37e60cb0f1efa8271bb402ee550_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:3780

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 ace7a1d5731e5fa5dbebe47579ed8b74f65357abac32d5be2ae5d9af1b4964a5
MD5 2f0fb49fa0af5f60bac0e8eab612ec17
SHA1 e8819a8ab5a23fe96f9ce7a96669d60153934042
SHA512 ac0cd0b3ce8c07c4cb016c3d3e593fb967befd8ac9617a72af936d72aed4becc1448ea64db577fda714808bf20a3d858cf9bba2c6fcd868d75916850fb88672f
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5yiB8GMGlZ5G:zv+vTpGdqU7uy5w9WMyiN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/996-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3780-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download