38958765bfd376e6e85a2deadf937e1edd7eaea680905e1f40ae64742f425914

Analysis

max time kernel
129s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 03:37

Target
8c06fd2caa2d1fa01b2a1112b8465de0_NeikiAnalytics.exe
Size 79KB
Sample240601-d6r2rahb76
SHA256 38958765bfd376e6e85a2deadf937e1edd7eaea680905e1f40ae64742f425914
MD5 8c06fd2caa2d1fa01b2a1112b8465de0
SHA1 8eddd67b1adec4455e221f6824d12dc817e3ba21
SHA512 4e411365cd9877dbc15af45c94c19f0b9c31bd041053b15a100fa278d4ebdb8752cc0738d3fe37cdfe27fa61b37c132d30bb6542ace2de02c30bce799e8255b5
SSDEEP 1536:zvKe+jx+KPqU42NOQA8AkqUhMb2nuy5wgIP0CSJ+5y6B8GMGlZ5G:zvz00uqU42UGdqU7uy5w9WMy6N5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3340	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2708	2580	8c06fd2caa2d1fa01b2a1112b8465de0_NeikiAnalytics.exe	83
PID 2580 wrote to memory of 2708	2580	8c06fd2caa2d1fa01b2a1112b8465de0_NeikiAnalytics.exe	83
PID 2580 wrote to memory of 2708	2580	8c06fd2caa2d1fa01b2a1112b8465de0_NeikiAnalytics.exe	83
PID 2708 wrote to memory of 3340	2708	cmd.exe	84
PID 2708 wrote to memory of 3340	2708	cmd.exe	84
PID 2708 wrote to memory of 3340	2708	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\8c06fd2caa2d1fa01b2a1112b8465de0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8c06fd2caa2d1fa01b2a1112b8465de0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:3340

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 d3f03e505b3c2f8c094e6060055668607c22fd7c3c37c3bc56b4b9b4ae36a867
MD5 7a54bf03686d69132930375bc22ab5cc
SHA1 c4ea73b540c57170fa91ee5c179343d1b74abf90
SHA512 44e55a139dfed50ab3da0862335aea2f65f30afe9c8339b5a49d6fc44b88d132aace884460617a4af4ad221af5683fbfd69558187c66df6ff89f50be8a27e3a5
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5yeB8GMGlZ5G:zv+vTpGdqU7uy5w9WMyeN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2580-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3340-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download