fd4ab42a7369263cbcec0b3161b672c29867585565588f2b9c582e854df54c54

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:16

Target
a176fb8d187c52d2ec0c9a942b89cb80_NeikiAnalytics.exe
Size 79KB
Sample240603-ndeaasce4s
SHA256 fd4ab42a7369263cbcec0b3161b672c29867585565588f2b9c582e854df54c54
MD5 a176fb8d187c52d2ec0c9a942b89cb80
SHA1 3640c0a51e5f65a8421b9ac5c70b1b02891dd9a8
SHA512 58543a8f4aea36b859ae950d4af5304a0c43d8b3493f140c64fe37fcb2f55e08e14fcef302cbc1cff86e0d7bfd8f7dff64e043036870ff3ee4bee2796e85ff86
SSDEEP 1536:zveqMOWly+1LMS6T5S0KiOQA8AkqUhMb2nuy5wgIP0CSJ+5yFB8GMGlZ5G:zvevOW916TI0yGdqU7uy5w9WMyFN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1596	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 4932	2580	a176fb8d187c52d2ec0c9a942b89cb80_NeikiAnalytics.exe	83
PID 2580 wrote to memory of 4932	2580	a176fb8d187c52d2ec0c9a942b89cb80_NeikiAnalytics.exe	83
PID 2580 wrote to memory of 4932	2580	a176fb8d187c52d2ec0c9a942b89cb80_NeikiAnalytics.exe	83
PID 4932 wrote to memory of 1596	4932	cmd.exe	84
PID 4932 wrote to memory of 1596	4932	cmd.exe	84
PID 4932 wrote to memory of 1596	4932	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\a176fb8d187c52d2ec0c9a942b89cb80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a176fb8d187c52d2ec0c9a942b89cb80_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:1596

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 5d9dd7ce73b0b1bbaefcb7a16ef112c15a70dc29bee5c7a24dc71d5a0dd171ab
MD5 4ef53ba021634bcebb34c444a7b7eef2
SHA1 53d1f7faac03644e3ad955095ff8653002043a48
SHA512 ca9aada9cab8ae9b0efbada9bd8e3321b04295541c6a98b55a38b51d6b72392efca4a3d052febcddbe456464e81a392ddd6550a59c7f79b74053cbc6ae3c48ea
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5ydB8GMGlZ5G:zv+vTpGdqU7uy5w9WMydN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1596-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2580-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download