828e8b4ac2e8ce523544b5cf1c0fec6c4d8fe24ce9934bdc0d1c1d4de89cc3c1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:15

Target
a16f3309f260d65e3c402201d90ce950_NeikiAnalytics.exe
Size 73KB
Sample240603-nch7vsdg87
SHA256 828e8b4ac2e8ce523544b5cf1c0fec6c4d8fe24ce9934bdc0d1c1d4de89cc3c1
MD5 a16f3309f260d65e3c402201d90ce950
SHA1 48c073de2953842522eb9024557a95934d9d2037
SHA512 54e06972ae153e6bf4b121e70605d8d61fe22f96b3566b5daf631ab85017c70b880b6a3f5a29b997e3be1c0632d9da2a3af44dda039cee7e2f6b856b178a3d42
SSDEEP 1536:hbByFaQCnp1682K5QPqfhVWbdsmA+RjPFLC+e5hW90ZGUGf2g:hNyIQCD67NPqfcxA+HFshGOg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
752	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 1156	1588	a16f3309f260d65e3c402201d90ce950_NeikiAnalytics.exe	83
PID 1588 wrote to memory of 1156	1588	a16f3309f260d65e3c402201d90ce950_NeikiAnalytics.exe	83
PID 1588 wrote to memory of 1156	1588	a16f3309f260d65e3c402201d90ce950_NeikiAnalytics.exe	83
PID 1156 wrote to memory of 752	1156	cmd.exe	84
PID 1156 wrote to memory of 752	1156	cmd.exe	84
PID 1156 wrote to memory of 752	1156	cmd.exe	84
PID 752 wrote to memory of 1180	752	[email protected]	85
PID 752 wrote to memory of 1180	752	[email protected]	85
PID 752 wrote to memory of 1180	752	[email protected]	85

C:\Users\Admin\AppData\Local\Temp\a16f3309f260d65e3c402201d90ce950_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a16f3309f260d65e3c402201d90ce950_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:752
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 16256.exe
      4⤵
      PID:1180

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 73KB
SHA256 249fdb93861b195d8d50d8a384afbef119b0f511f9d6b8af20673855e5bc3208
MD5 76b08fb3c20c2461943ef339bc992779
SHA1 a5c67a5f815da1cff3b894a34f3466287e24c3fe
SHA512 765ea79d0eb3f42b1771bf8dd0773cca6839b53dbea0ea794f23275afa0fbe3b05c7126f93ab2e0dd1095f7e9a1c03b7eb7e48ec650d51752dfd1871eed4e284
SSDEEP 1536:hbSYv9ZK5QPqfhVWbdsmA+RjPFLC+e5hG90ZGUGf2g:hGYvHNPqfcxA+HFsh2Og
MD5 SHA1 SHA512 SSDEEP

Submit Download

16256.exe

Path C:\Users\Admin\AppData\Local\Temp\16256.exe
Size 2KB
SHA256 bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991
MD5 7b621943a35e7f39cf89f50cc48d7b94
SHA1 2858a28cf60f38025fffcd0ba2ecfec8511c197d
SHA512 4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1
MD5 SHA1 SHA512

Submit Download

memory/752-7-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/1588-8-0x0000000000400000-0x0000000000419000-memory.dmp

Download