9c0d0a88a0a88e201d487f37a84d2ccad4c77d2f7a43664c71288a0442d4ef25

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:32

Target
a1e89ce49adf546b54d6d8a10bd0ac30_NeikiAnalytics.exe
Size 79KB
Sample240603-nnct8ach51
SHA256 9c0d0a88a0a88e201d487f37a84d2ccad4c77d2f7a43664c71288a0442d4ef25
MD5 a1e89ce49adf546b54d6d8a10bd0ac30
SHA1 ca36dad00d06a77f119981f3cb71ad92ebe26ab4
SHA512 b431a34867e1e62dd7d35256dc013cf1e7e5c2d538dcc6df374fdd5caeb1246b94b036c149565be170ceec843b8bc9d571656d30a6f7219fe6dda2dc96e962fc
SSDEEP 1536:zvANfA7voIfaFOQA8AkqUhMb2nuy5wgIP0CSJ+5y0B8GMGlZ5G:zvANfvi9GdqU7uy5w9WMy0N5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2516	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 2460	3420	a1e89ce49adf546b54d6d8a10bd0ac30_NeikiAnalytics.exe	83
PID 3420 wrote to memory of 2460	3420	a1e89ce49adf546b54d6d8a10bd0ac30_NeikiAnalytics.exe	83
PID 3420 wrote to memory of 2460	3420	a1e89ce49adf546b54d6d8a10bd0ac30_NeikiAnalytics.exe	83
PID 2460 wrote to memory of 2516	2460	cmd.exe	84
PID 2460 wrote to memory of 2516	2460	cmd.exe	84
PID 2460 wrote to memory of 2516	2460	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\a1e89ce49adf546b54d6d8a10bd0ac30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a1e89ce49adf546b54d6d8a10bd0ac30_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2516

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 f556f1f2de5599cf9c08b20e1b683f241c194a8aefbdbc6a6cb1516448f6bfb6
MD5 896f2ef935cfc2b15337992e6783222c
SHA1 0994a91e5dbebe15acf61ce4796a3c38e0110ab8
SHA512 62fb9a8c80c17c70c758facf189e661bd6af628e5fabd4c3aca171990db762231a97fe835246ae630c72238c2ec6aaa57830699e0e181d95631966949cd48b7a
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5yMB8GMGlZ5G:zv+vTpGdqU7uy5w9WMyMN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2516-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3420-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download