75999a7629ab58cc6186e627c306543db7c6a852d43b210e60f4755b0201a987

Analysis

max time kernel
133s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:07

Target
a2d8e5c0e9fd0244721412e5151fd530_NeikiAnalytics.exe
Size 79KB
Sample240603-padp2afb38
SHA256 75999a7629ab58cc6186e627c306543db7c6a852d43b210e60f4755b0201a987
MD5 a2d8e5c0e9fd0244721412e5151fd530
SHA1 73192425861a1fb8501d84d577d21c764d04352c
SHA512 7ef785ee699617c470f633c5126ce661bf01fd07ba28463fc8916dbf4e5ab1e9f6214c57680ccc672a98dcfdae24c92dc5646720d45ad57e2269cc424719a16c
SSDEEP 1536:zvqdANke+cTyY27OQA8AkqUhMb2nuy5wgIP0CSJ+5yEB8GMGlZ5G:zvqSye+ElGdqU7uy5w9WMyEN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
828	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 4772	4088	a2d8e5c0e9fd0244721412e5151fd530_NeikiAnalytics.exe	84
PID 4088 wrote to memory of 4772	4088	a2d8e5c0e9fd0244721412e5151fd530_NeikiAnalytics.exe	84
PID 4088 wrote to memory of 4772	4088	a2d8e5c0e9fd0244721412e5151fd530_NeikiAnalytics.exe	84
PID 4772 wrote to memory of 828	4772	cmd.exe	85
PID 4772 wrote to memory of 828	4772	cmd.exe	85
PID 4772 wrote to memory of 828	4772	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\a2d8e5c0e9fd0244721412e5151fd530_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a2d8e5c0e9fd0244721412e5151fd530_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:828

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 7b370dd3c5bcf897042b365814f4babef21c1fc3e8100e7466dc9fbf5a5ddb9d
MD5 319972491faa7937a851cff4a613d81a
SHA1 b8bdcac6aa018640e6d4da2781d80948e8f9c308
SHA512 46082f39184c34361ab210a312d46621aa514e9492d6be8650c9f4db22caf240b90de18d4e93cd821b691e240ef2cc81d9fec829bfb13066ec21e730e1135af4
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5yeB8GMGlZ5G:zv+vTpGdqU7uy5w9WMyeN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/828-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4088-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download