6c0f0fafc9310c174af6f73f2fa1089f1bcffa296da5a1c5ef6f12690aa18b00

Analysis

max time kernel
129s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:14

Target
a317904c98a1e08f89ab08f4d4ef36b0_NeikiAnalytics.exe
Size 79KB
Sample240603-pen2kaea8v
SHA256 6c0f0fafc9310c174af6f73f2fa1089f1bcffa296da5a1c5ef6f12690aa18b00
MD5 a317904c98a1e08f89ab08f4d4ef36b0
SHA1 f10df3fa58c5a1fb9b890c565af1422195f9bbe9
SHA512 9a6d7e0de25406acf57dcabd7fd90af7105f883ae95b2e2325c6cff8874b8944a746229bc3033b667bda38be34f9dc09a7388db6fec551255a737ad62d427323
SSDEEP 1536:zvpe1QMQ+OQA8AkqUhMb2nuy5wgIP0CSJ+5ycB8GMGlZ5G:zvpe1crGdqU7uy5w9WMycN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
5064	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 4460	1480	a317904c98a1e08f89ab08f4d4ef36b0_NeikiAnalytics.exe	84
PID 1480 wrote to memory of 4460	1480	a317904c98a1e08f89ab08f4d4ef36b0_NeikiAnalytics.exe	84
PID 1480 wrote to memory of 4460	1480	a317904c98a1e08f89ab08f4d4ef36b0_NeikiAnalytics.exe	84
PID 4460 wrote to memory of 5064	4460	cmd.exe	85
PID 4460 wrote to memory of 5064	4460	cmd.exe	85
PID 4460 wrote to memory of 5064	4460	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\a317904c98a1e08f89ab08f4d4ef36b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a317904c98a1e08f89ab08f4d4ef36b0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:5064

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 cec795ee3efa1b64dbc5e8ca82012f75d74f82daa4b81a1a10639e46adfda213
MD5 d19281cef55f123ad81ee57b18835665
SHA1 c4becdef728e210c6796d3f12ec97aea9e9bd3c9
SHA512 4933985ee530c1758355e5cc2244129437506bf0b3a5fc215ff88044222971605bbc63339f7a374f9b3e71f33fc5efe723eee304f4123f08b79d2ca55be407b7
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5yyB8GMGlZ5G:zv+vTpGdqU7uy5w9WMyyN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1480-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5064-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download