6a4a97613f197261fd9ea7e3f022add9580c88be5baea614c130fa2946cfbae2

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 10:22

Target
5104586f13e3c8c232d0a8aa95b37e30_NeikiAnalytics.exe
Size 79KB
Sample240529-meef1scb47
SHA256 6a4a97613f197261fd9ea7e3f022add9580c88be5baea614c130fa2946cfbae2
MD5 5104586f13e3c8c232d0a8aa95b37e30
SHA1 95cfadab763e1c718595ae022da07cfa0f55f280
SHA512 b760c49e9518ccfc07422ecd7f2f944d834dcf2fb9e110db1679de9be7be24520b04205b965c73b8783843476254354ccf9163bb666c989af0ac80adb2b37770
SSDEEP 1536:zvRuv1tGrE12B5nOQA8AkqUhMb2nuy5wgIP0CSJ+5yoB8GMGlZ5G:zvRumrJfOGdqU7uy5w9WMyoN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3496	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 848	2564	5104586f13e3c8c232d0a8aa95b37e30_NeikiAnalytics.exe	86
PID 2564 wrote to memory of 848	2564	5104586f13e3c8c232d0a8aa95b37e30_NeikiAnalytics.exe	86
PID 2564 wrote to memory of 848	2564	5104586f13e3c8c232d0a8aa95b37e30_NeikiAnalytics.exe	86
PID 848 wrote to memory of 3496	848	cmd.exe	87
PID 848 wrote to memory of 3496	848	cmd.exe	87
PID 848 wrote to memory of 3496	848	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\5104586f13e3c8c232d0a8aa95b37e30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5104586f13e3c8c232d0a8aa95b37e30_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:3496

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 2de65829dbbdf781844ba73abac28f6e035d017d005180d9748aa1577143e80b
MD5 4885d9d4807b24954c0afbda997eff57
SHA1 d6c7b660d772e0f43343f9d0d8c7c6fcae7f5dde
SHA512 4120119aa469e6baa43b7c04b018e43f895223340a241591e6f3749f051a660dad3d4bf15c22cdc8abd190a5bfae651fbe770fe8b5cd0169d288021d36a40a68
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5ymB8GMGlZ5G:zv+vTpGdqU7uy5w9WMymN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2564-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3496-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download