a52ad4b25388a1cee921423c09bec39a728912fcc31cb3042133b191d688df35

Analysis

max time kernel
94s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 04:23

Target
6452d17887e1e4fae2a1b8db2f2abf80_NeikiAnalytics.exe
Size 79KB
Sample240530-ez7pasfd59
SHA256 a52ad4b25388a1cee921423c09bec39a728912fcc31cb3042133b191d688df35
MD5 6452d17887e1e4fae2a1b8db2f2abf80
SHA1 a473cbb2eee72ce6560e5785c7baefba2de34144
SHA512 3eb55389840c18f1e3eb07fe792055f023e4498a36c94dbc9773f0ca3b8c36033ab79c5bd06ada29e1edb86505aba19fd0a7c6d54027a1ef21c3811bb6ef6ce4
SSDEEP 1536:zv0IAhkxR/QlJUOQA8AkqUhMb2nuy5wgIP0CSJ+5ygB8GMGlZ5G:zvKWxR/IHGdqU7uy5w9WMygN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
536	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 1256	3408	6452d17887e1e4fae2a1b8db2f2abf80_NeikiAnalytics.exe	83
PID 3408 wrote to memory of 1256	3408	6452d17887e1e4fae2a1b8db2f2abf80_NeikiAnalytics.exe	83
PID 3408 wrote to memory of 1256	3408	6452d17887e1e4fae2a1b8db2f2abf80_NeikiAnalytics.exe	83
PID 1256 wrote to memory of 536	1256	cmd.exe	84
PID 1256 wrote to memory of 536	1256	cmd.exe	84
PID 1256 wrote to memory of 536	1256	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\6452d17887e1e4fae2a1b8db2f2abf80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6452d17887e1e4fae2a1b8db2f2abf80_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:536

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 063996dd20f08bff90048b294e36395a74a3b3942b8fb7a4ea918becf427e6c4
MD5 302a69d664738d2f5f882cd32b9cf905
SHA1 08324577c3cb4689b471001de7a13d5bf77d6c8e
SHA512 218db7467558774accb941580532c7e3b15ab6910bacb50eef4a08010d52e1da43c700d882a9bdcc6f348cd459a9ef89108b08268fbca28e0744cd0e0a7b6982
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5y6B8GMGlZ5G:zv+vTpGdqU7uy5w9WMy6N5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/536-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3408-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download