2f1019c468ed3f5ab3176af544a78bf516a1d6f78c10e0cf2d95f6018f17a78d

Analysis

max time kernel
133s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 06:32

Target
36baefdb156cdcc426e344f9dfb10df0_NeikiAnalytics.exe
Size 73KB
Sample240528-halbjshd6v
SHA256 2f1019c468ed3f5ab3176af544a78bf516a1d6f78c10e0cf2d95f6018f17a78d
MD5 36baefdb156cdcc426e344f9dfb10df0
SHA1 832a4771f786189f8fdb6b42ceed85444fd57f66
SHA512 daf62fe37cf715ac193665e90545e426c3038ee573b7cb9f521c50ccae2234601f03b3897e8ee4b44100bff74a36abf1cb799e31cd9f60ea7210c04c057eb18c
SSDEEP 1536:hbNORVbD8S+tWK5QPqfhVWbdsmA+RjPFLC+e5hv0ZGUGf2g:hZwbPNPqfcxA+HFshvOg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2388	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 1268	4820	36baefdb156cdcc426e344f9dfb10df0_NeikiAnalytics.exe	83
PID 4820 wrote to memory of 1268	4820	36baefdb156cdcc426e344f9dfb10df0_NeikiAnalytics.exe	83
PID 4820 wrote to memory of 1268	4820	36baefdb156cdcc426e344f9dfb10df0_NeikiAnalytics.exe	83
PID 1268 wrote to memory of 2388	1268	cmd.exe	85
PID 1268 wrote to memory of 2388	1268	cmd.exe	85
PID 1268 wrote to memory of 2388	1268	cmd.exe	85
PID 2388 wrote to memory of 228	2388	[email protected]	86
PID 2388 wrote to memory of 228	2388	[email protected]	86
PID 2388 wrote to memory of 228	2388	[email protected]	86

C:\Users\Admin\AppData\Local\Temp\36baefdb156cdcc426e344f9dfb10df0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\36baefdb156cdcc426e344f9dfb10df0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:228

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 73KB
SHA256 acb7ef3229b4da2412c66279a71c3d8c29a0226a6531841eea50867b441b1eae
MD5 622f64e96c1dccf2f6fb0c88879b1bd9
SHA1 237238176b7c1ee4b2900186e9e8ba6b5e9e3984
SHA512 baf01e734a9453c9b277f0a21122f540ebf37d13596c5396f0748c1c2b367c88235936a5d551a9dcdef30cc8e2a1f85a98faed09e9b2a45a263cd68b356b3ffd
SSDEEP 1536:hbSYv9ZK5QPqfhVWbdsmA+RjPFLC+e5hL0ZGUGf2g:hGYvHNPqfcxA+HFshLOg
MD5 SHA1 SHA512 SSDEEP

Submit Download

00.exe

Path C:\Users\Admin\AppData\Local\Temp\00.exe
Size 2KB
SHA256 bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991
MD5 7b621943a35e7f39cf89f50cc48d7b94
SHA1 2858a28cf60f38025fffcd0ba2ecfec8511c197d
SHA512 4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1
MD5 SHA1 SHA512

Submit Download

memory/2388-7-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/4820-8-0x0000000000400000-0x0000000000419000-memory.dmp

Download