3c1b7edabf059c92ccf40ee338b4efe5b9ebd7aaa6aabafbf0d9a9051869d637

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 11:01

Target
52537e8c1350022a51a3bc82c7a99310_NeikiAnalytics.exe
Size 73KB
Sample240529-m4spyada73
SHA256 3c1b7edabf059c92ccf40ee338b4efe5b9ebd7aaa6aabafbf0d9a9051869d637
MD5 52537e8c1350022a51a3bc82c7a99310
SHA1 8dc5fcab3aa32a9996dbbaa52e85c128dbfa4f11
SHA512 8612da056b888c37eab7167aaef1d452990535059d2f3f7c9b8d97d030a5b169be7b3a880fb71b5d3f80737ea1442f8529b3d4130da991771c59a2d1ab4662bb
SSDEEP 1536:hbnSKkXeOK5QPqfhVWbdsmA+RjPFLC+e5hr0ZGUGf2g:hzSTDNPqfcxA+HFshrOg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3580	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 4400	4916	52537e8c1350022a51a3bc82c7a99310_NeikiAnalytics.exe	86
PID 4916 wrote to memory of 4400	4916	52537e8c1350022a51a3bc82c7a99310_NeikiAnalytics.exe	86
PID 4916 wrote to memory of 4400	4916	52537e8c1350022a51a3bc82c7a99310_NeikiAnalytics.exe	86
PID 4400 wrote to memory of 3580	4400	cmd.exe	87
PID 4400 wrote to memory of 3580	4400	cmd.exe	87
PID 4400 wrote to memory of 3580	4400	cmd.exe	87
PID 3580 wrote to memory of 3740	3580	[email protected]	88
PID 3580 wrote to memory of 3740	3580	[email protected]	88
PID 3580 wrote to memory of 3740	3580	[email protected]	88

C:\Users\Admin\AppData\Local\Temp\52537e8c1350022a51a3bc82c7a99310_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\52537e8c1350022a51a3bc82c7a99310_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:3740

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 73KB
SHA256 a53fc63b3ebe8fe90a131e2e93d46c255baa908afc54d96755e2152fd650d800
MD5 6a8c8404eda5ce61486396bf3cd4b8da
SHA1 8b7757ee66e1b40e842aaed39776540b72d5b913
SHA512 965c6c0351be5a4720ece159e3ecce583952a15c72de761f5d438145cfa25b653428d188dc7656c820a4775f4ce19f5af94aa8914a042a8dec9ca3ea7d4792ce
SSDEEP 1536:hbSYv9ZK5QPqfhVWbdsmA+RjPFLC+e5h/0ZGUGf2g:hGYvHNPqfcxA+HFsh/Og
MD5 SHA1 SHA512 SSDEEP

Submit Download

00.exe

Path C:\Users\Admin\AppData\Local\Temp\00.exe
Size 2KB
SHA256 bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991
MD5 7b621943a35e7f39cf89f50cc48d7b94
SHA1 2858a28cf60f38025fffcd0ba2ecfec8511c197d
SHA512 4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1
MD5 SHA1 SHA512

Submit Download

memory/3580-7-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/4916-8-0x0000000000400000-0x0000000000419000-memory.dmp

Download