8c4ad780c3bf803e1d2d58ffd1984082f4e9cfae57ea0e197b5746fa65bd808c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 04:10

Target
63d74ac262b97c700d21374df60bb160_NeikiAnalytics.exe
Size 73KB
Sample240530-errccaea5y
SHA256 8c4ad780c3bf803e1d2d58ffd1984082f4e9cfae57ea0e197b5746fa65bd808c
MD5 63d74ac262b97c700d21374df60bb160
SHA1 5e874f8b5ff022d928c3338991544671b4e7a598
SHA512 038e46561ad1eee822bad80c85df76966f2d987964cec63d75cfd89517beb9c312474f8755a7946a4075b396676279cae755b76978e2c22aec76f53f30e906bb
SSDEEP 1536:hbyj/7u79TnnR7K5QPqfhVWbdsmA+RjPFLC+e5ho0ZGUGf2g:h+j/7Cl7NPqfcxA+HFshoOg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2720	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 4296	1724	63d74ac262b97c700d21374df60bb160_NeikiAnalytics.exe	84
PID 1724 wrote to memory of 4296	1724	63d74ac262b97c700d21374df60bb160_NeikiAnalytics.exe	84
PID 1724 wrote to memory of 4296	1724	63d74ac262b97c700d21374df60bb160_NeikiAnalytics.exe	84
PID 4296 wrote to memory of 2720	4296	cmd.exe	85
PID 4296 wrote to memory of 2720	4296	cmd.exe	85
PID 4296 wrote to memory of 2720	4296	cmd.exe	85
PID 2720 wrote to memory of 1068	2720	[email protected]	86
PID 2720 wrote to memory of 1068	2720	[email protected]	86
PID 2720 wrote to memory of 1068	2720	[email protected]	86

C:\Users\Admin\AppData\Local\Temp\63d74ac262b97c700d21374df60bb160_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\63d74ac262b97c700d21374df60bb160_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:1068

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 73KB
SHA256 e3b936bd8753c1c4004e891ed4ef5eb6f18a600636ea8dfe36b54941a784ae3f
MD5 b0c22b369857308d7b6ceb582cdd3399
SHA1 4ddf777daa75cc0966107e1544263735c183526d
SHA512 4b9642606b9cbbca593112707b9779251c87315e006b1c20aa90a3ec927ab7929ba0bf0d37cedc10ddadf035732711fc2508d66fb8f5baddf3df4c142500e0bb
SSDEEP 1536:hbSYv9ZK5QPqfhVWbdsmA+RjPFLC+e5hy0ZGUGf2g:hGYvHNPqfcxA+HFshyOg
MD5 SHA1 SHA512 SSDEEP

Submit Download

00.exe

Path C:\Users\Admin\AppData\Local\Temp\00.exe
Size 2KB
SHA256 bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991
MD5 7b621943a35e7f39cf89f50cc48d7b94
SHA1 2858a28cf60f38025fffcd0ba2ecfec8511c197d
SHA512 4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1
MD5 SHA1 SHA512

Submit Download

memory/1724-8-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/2720-7-0x0000000000400000-0x0000000000419000-memory.dmp

Download