9ea206bbed1de3e0e515d5cc2cb1ef378e6aa63c8a3e24e5f7021e863d2b0912

Analysis

max time kernel
141s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:01

Target
a2b3a922d5e1c054c499ecb963044060_NeikiAnalytics.exe
Size 79KB
Sample240603-n68plsfa38
SHA256 9ea206bbed1de3e0e515d5cc2cb1ef378e6aa63c8a3e24e5f7021e863d2b0912
MD5 a2b3a922d5e1c054c499ecb963044060
SHA1 9ebc59cc0ae8a5d03a3e2c4b3a3e1a50f432bbb1
SHA512 1ed01cd41787cda6bb946a382f2aebf50faa552ee6d501703dec284929f8b2e9961a08f5a86e8f51e1af3b32294a57a1acec83265de0003a39c4c50c957d7f04
SSDEEP 1536:zvNY1FBub1Ht0OQA8AkqUhMb2nuy5wgIP0CSJ+5yJB8GMGlZ5G:zvNQFexGdqU7uy5w9WMyJN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3272	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 5048	2864	a2b3a922d5e1c054c499ecb963044060_NeikiAnalytics.exe	85
PID 2864 wrote to memory of 5048	2864	a2b3a922d5e1c054c499ecb963044060_NeikiAnalytics.exe	85
PID 2864 wrote to memory of 5048	2864	a2b3a922d5e1c054c499ecb963044060_NeikiAnalytics.exe	85
PID 5048 wrote to memory of 3272	5048	cmd.exe	86
PID 5048 wrote to memory of 3272	5048	cmd.exe	86
PID 5048 wrote to memory of 3272	5048	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\a2b3a922d5e1c054c499ecb963044060_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a2b3a922d5e1c054c499ecb963044060_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:3272

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 d878329a20a425d73e976dc23a0c3a2d072880771d13c12b78b753bb37a2de34
MD5 7e5d141f15c645b58d0e955c4d09a1ba
SHA1 3bf6d0d210bee8c253d91975212f7958c82c2723
SHA512 4ab6383ece839df0c1154ae0287615316bb40649c49753f796ea5af17db95fae8d28b0f3b0f1316e23357abaaef3e24a9eb9d95c5a283f8e8ffd485a0bf043e6
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5yZB8GMGlZ5G:zv+vTpGdqU7uy5w9WMyZN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2864-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3272-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download