a04916ecbc552efcfc58be9d2452411f4c84638827eb13de7434b393e06fab17

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 10:56

Target
a0e9c0b6ee4177e8c4e77c7ff506e7f0_NeikiAnalytics.exe
Size 79KB
Sample240603-m1636add44
SHA256 a04916ecbc552efcfc58be9d2452411f4c84638827eb13de7434b393e06fab17
MD5 a0e9c0b6ee4177e8c4e77c7ff506e7f0
SHA1 ab67b5cf58017adf843304392d0f550ad8c9413b
SHA512 2704ab91daa140d7f8d4f3e2e8d784cc5d82e0e833e2e7a453a1246b6466e38b541a750ada802da2428931fda903125b64bcc9128b78110dfe43dcc9208f5ff8
SSDEEP 1536:zvoUHHTaOk7m6AtjOQA8AkqUhMb2nuy5wgIP0CSJ+5ylB8GMGlZ5G:zvoUHH2O8pHGdqU7uy5w9WMylN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
312	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 2460	4504	a0e9c0b6ee4177e8c4e77c7ff506e7f0_NeikiAnalytics.exe	83
PID 4504 wrote to memory of 2460	4504	a0e9c0b6ee4177e8c4e77c7ff506e7f0_NeikiAnalytics.exe	83
PID 4504 wrote to memory of 2460	4504	a0e9c0b6ee4177e8c4e77c7ff506e7f0_NeikiAnalytics.exe	83
PID 2460 wrote to memory of 312	2460	cmd.exe	84
PID 2460 wrote to memory of 312	2460	cmd.exe	84
PID 2460 wrote to memory of 312	2460	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\a0e9c0b6ee4177e8c4e77c7ff506e7f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a0e9c0b6ee4177e8c4e77c7ff506e7f0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:312

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 4dfbe7868dc5c301966b9ed09ca8db5c41991ff60bd133f195c491a36b78917b
MD5 ef8c6b60c0c31c90a1d22b83766fbb98
SHA1 4ca2eb5219f16dcdf1b51c7a592652a838cbe8bc
SHA512 1785e3058b06b6d1cb28f2c0de9a04ba8f538bbd58a45769d1f9d3d57d40e67a78c505b6f3420252efaf76e2cee0881ace33230bd10609f9b18e654e7d3319b6
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5ydB8GMGlZ5G:zv+vTpGdqU7uy5w9WMydN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/312-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4504-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download