ad5e5d6aa57e5cb9c180f5a6af25e347fdbfee0fb643a7e330e42c0d5ec14e9d

Analysis

max time kernel
133s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:42

Target
a2399c9dc3e4f7b3d8b812249648e320_NeikiAnalytics.exe
Size 79KB
Sample240603-nvg3hsdc41
SHA256 ad5e5d6aa57e5cb9c180f5a6af25e347fdbfee0fb643a7e330e42c0d5ec14e9d
MD5 a2399c9dc3e4f7b3d8b812249648e320
SHA1 164df6fee5e25d053fd54ebe01d3224a87c5993d
SHA512 7838943c2cff4d7f52cfb9e280903935b2f4aa666bce64af0e4c1de911d81ac3e7497ac43b69a57a6e425a156a7663da891d91eaff8e57ccc64734b430584792
SSDEEP 1536:zvoO0/7E2BzTQTFOQA8AkqUhMb2nuy5wgIP0CSJ+5ybB8GMGlZ5G:zvL0/Y2lTQTcGdqU7uy5w9WMybN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4536	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 1472	4248	a2399c9dc3e4f7b3d8b812249648e320_NeikiAnalytics.exe	83
PID 4248 wrote to memory of 1472	4248	a2399c9dc3e4f7b3d8b812249648e320_NeikiAnalytics.exe	83
PID 4248 wrote to memory of 1472	4248	a2399c9dc3e4f7b3d8b812249648e320_NeikiAnalytics.exe	83
PID 1472 wrote to memory of 4536	1472	cmd.exe	84
PID 1472 wrote to memory of 4536	1472	cmd.exe	84
PID 1472 wrote to memory of 4536	1472	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\a2399c9dc3e4f7b3d8b812249648e320_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a2399c9dc3e4f7b3d8b812249648e320_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:4536

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 0ce530a0cd406b5e635405a1a649f2b0f995b28ffb406ec75da324f7c84319f9
MD5 e984ce878f7933f0ba0068a5783e6f68
SHA1 259987a0b92368fcbd73bec6e4f3b7064de96025
SHA512 99ae979634fdaf3413fbad27474c667c3bfa6666d445f22f4cd9406b29ad8b7200fa2fcea2a586337a4d0254e9bf86134f203c27bc4771224127a2bbd5ebdb17
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5ypB8GMGlZ5G:zv+vTpGdqU7uy5w9WMypN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4248-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4536-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download