04b9f7fca5b4092d1caaeb718fc4d15c845ebe23d93509a1d41a0b18af45b228

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:44

Target
a3dfaf4823cb75cf6a316ad334927790_NeikiAnalytics.exe
Size 79KB
Sample240603-pymylsgc29
SHA256 04b9f7fca5b4092d1caaeb718fc4d15c845ebe23d93509a1d41a0b18af45b228
MD5 a3dfaf4823cb75cf6a316ad334927790
SHA1 cbd54c12b3e028444292d133f18afafb6b550925
SHA512 42090b4cc812aa220b5ee74f4373d8acf8ce361015d318b1d1735c649d45c6cfa7d43b54e2adabe2ecb8ef66ddb162c1b69a5e6772954d9585b47e1b83429d4f
SSDEEP 1536:zvSPRRRf384f0+zOQA8AkqUhMb2nuy5wgIP0CSJ+5yAB8GMGlZ5G:zv0RRRfZfQGdqU7uy5w9WMyAN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1076	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 3152	3700	a3dfaf4823cb75cf6a316ad334927790_NeikiAnalytics.exe	82
PID 3700 wrote to memory of 3152	3700	a3dfaf4823cb75cf6a316ad334927790_NeikiAnalytics.exe	82
PID 3700 wrote to memory of 3152	3700	a3dfaf4823cb75cf6a316ad334927790_NeikiAnalytics.exe	82
PID 3152 wrote to memory of 1076	3152	cmd.exe	83
PID 3152 wrote to memory of 1076	3152	cmd.exe	83
PID 3152 wrote to memory of 1076	3152	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\a3dfaf4823cb75cf6a316ad334927790_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a3dfaf4823cb75cf6a316ad334927790_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:1076

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 a9821190c8b1cda97ef379f1ebe1f6527ab64038cd02f35b46bc2ebe3b62d873
MD5 78332ae5730e8aacf954b037d941a514
SHA1 ac1586b9627185356064849e05b75dbaf5cd2e60
SHA512 61118de3109f711ed9a265a5a0572f79ff8039d2c90a74ec7648f78d5bbc46146fb2b2151a3cdf322ef1bec5afb950aa8046fe71710756bc97c1e9c483441f96
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5ysB8GMGlZ5G:zv+vTpGdqU7uy5w9WMysN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1076-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3700-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download