9d79e2bb850635c9a37169305fdf823a1707b71685e25d8f77008b58d04f0ee6

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:48

Target
a3f67faebe5ba374c8cb619e5005e160_NeikiAnalytics.exe
Size 79KB
Sample240603-p126bagd29
SHA256 9d79e2bb850635c9a37169305fdf823a1707b71685e25d8f77008b58d04f0ee6
MD5 a3f67faebe5ba374c8cb619e5005e160
SHA1 66db9203107328a5532a064a23fb7d1129be7415
SHA512 b164a5b3263528c3a389259f9eaa319dda3e5d651218bed751a167ed978e9aa992e89e7e221647617c80de6ab1acf12ce8a1f1e91743234b911a032ee73e3678
SSDEEP 1536:zvKrQpiFOqL8oOQA8AkqUhMb2nuy5wgIP0CSJ+5y/8B8GMGlZ5G:zvK9QGdqU7uy5w9WMy/8N5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4840	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 760	4304	a3f67faebe5ba374c8cb619e5005e160_NeikiAnalytics.exe	82
PID 4304 wrote to memory of 760	4304	a3f67faebe5ba374c8cb619e5005e160_NeikiAnalytics.exe	82
PID 4304 wrote to memory of 760	4304	a3f67faebe5ba374c8cb619e5005e160_NeikiAnalytics.exe	82
PID 760 wrote to memory of 4840	760	cmd.exe	83
PID 760 wrote to memory of 4840	760	cmd.exe	83
PID 760 wrote to memory of 4840	760	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\a3f67faebe5ba374c8cb619e5005e160_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a3f67faebe5ba374c8cb619e5005e160_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:4840

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 e38f6518d3c5f93a7cbbd40d6dbef54fe155bb8daf48eb57486dc56bbc7e7ca5
MD5 d74b799c0d87f509e2515144d2d0e1e5
SHA1 dd4182064344d86966434373fa61c6ba1b3872d3
SHA512 295b19184d3690ba56dfbac292f0a156d32be90062fec6ce26a2abb4a7e25463d2a86844608fcc3b184e8bd21c77b3da565370ba217f6cf279adc7b74089f423
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5yZ8B8GMGlZ5G:zv+vTpGdqU7uy5w9WMyZ8N5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4304-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4840-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download