f8046dcce803ca206a087b65d26275fe4b259c493bcd0c9f7c69ee750865fbf3

Analysis

max time kernel
92s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 11:01

Target
525785947949fefab125e43c2f4f6090_NeikiAnalytics.exe
Size 79KB
Sample240529-m4xc5ada76
SHA256 f8046dcce803ca206a087b65d26275fe4b259c493bcd0c9f7c69ee750865fbf3
MD5 525785947949fefab125e43c2f4f6090
SHA1 a6a3776b43dcc69f90ba6b9a771add84d13007bb
SHA512 c2aeed9ee0913d2c7aea4614e786eec4fb225115c552ce4306e775220723573ae13ce7a5a04f2704cd58ba37a3828394cb365917acc4c80e9f2524c16196c1ce
SSDEEP 1536:zv3wR0ussR3OQA8AkqUhMb2nuy5wgIP0CSJ+5yJB8GMGlZ5G:zvHGdqU7uy5w9WMyJN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3640	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 3620	4272	525785947949fefab125e43c2f4f6090_NeikiAnalytics.exe	83
PID 4272 wrote to memory of 3620	4272	525785947949fefab125e43c2f4f6090_NeikiAnalytics.exe	83
PID 4272 wrote to memory of 3620	4272	525785947949fefab125e43c2f4f6090_NeikiAnalytics.exe	83
PID 3620 wrote to memory of 3640	3620	cmd.exe	84
PID 3620 wrote to memory of 3640	3620	cmd.exe	84
PID 3620 wrote to memory of 3640	3620	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\525785947949fefab125e43c2f4f6090_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\525785947949fefab125e43c2f4f6090_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:3640

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 7fef43236cc7a7e299d025921028d8f15fcb3e7171c1d6db859cc7b55a8414b2
MD5 a7aceb6eb1fd596d695a0319a33c7ee0
SHA1 310044f675b745b984788c5c19948b2ee6d924b1
SHA512 e21f212774ef0a0f3f2c1743bab476710da33f6382201d09ca543495da3f75e073cf3151951bdad1e9054988d18e4bc903f02f80e70a3f762418faa0e89e996e
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5ytB8GMGlZ5G:zv+vTpGdqU7uy5w9WMytN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3640-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4272-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download