e956a05337a8069ad5c4e2737d7c252c16e24d5ea690ad94eef45197141b2332

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 10:38

Target
518e6be8dad51856b5ca957f4920a850_NeikiAnalytics.exe
Size 79KB
Sample240529-mpmkdabg5s
SHA256 e956a05337a8069ad5c4e2737d7c252c16e24d5ea690ad94eef45197141b2332
MD5 518e6be8dad51856b5ca957f4920a850
SHA1 dcc40d87fe1e372aee89f6870b03a19642a5b14a
SHA512 bd11c4f90f09acd2d42f5b3cb004ab986c917315ed8266a1e29d01b5a5db6b6abfc874d86e3c0996dfd0517dd4d60d2f6a725d09a7ec3f6b823b31d3fb3e836f
SSDEEP 1536:zvZDxFNATJ3101H2OQA8AkqUhMb2nuy5wgIP0CSJ+5y8sB8GMGlZ5G:zvRxrATJozGdqU7uy5w9WMy8sN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
220	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 3968	4608	518e6be8dad51856b5ca957f4920a850_NeikiAnalytics.exe	83
PID 4608 wrote to memory of 3968	4608	518e6be8dad51856b5ca957f4920a850_NeikiAnalytics.exe	83
PID 4608 wrote to memory of 3968	4608	518e6be8dad51856b5ca957f4920a850_NeikiAnalytics.exe	83
PID 3968 wrote to memory of 220	3968	cmd.exe	84
PID 3968 wrote to memory of 220	3968	cmd.exe	84
PID 3968 wrote to memory of 220	3968	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\518e6be8dad51856b5ca957f4920a850_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\518e6be8dad51856b5ca957f4920a850_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:220

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 ff0cc84e357652f69f174e85825183ed220d768b91068b3a6b97832285b9e02c
MD5 9cb01bf00acb717c6163aa641d46d057
SHA1 27ab7af9011322abe2b6276eb4553b7d668411e8
SHA512 ef839c490d05e50c14ae2f3dfc6fefae172d9ddb7dab9b77042e69f020a51cf5283d63997b59320c996a58b5aee5ffa32300acc3d7417504d8daacfbfb575f44
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5ygsB8GMGlZ5G:zv+vTpGdqU7uy5w9WMygsN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4608-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download