9fab50f35f129bca48880cb763462c60aec5aec04fa2416392dca33352eb010c

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 15:57

Target
9fab50f35f129bca48880cb763462c60aec5aec04fa2416392dca33352eb010c_NeikiAnalytics.exe
Size 73KB
Sample240628-tealdsyfll
SHA256 9fab50f35f129bca48880cb763462c60aec5aec04fa2416392dca33352eb010c
MD5 01ff9ac41c76fa0c29253e07c140abc0
SHA1 2945c3ab47e1616adfbbb476df52a71279fff885
SHA512 168d502f2a0f6224c13e9f79b6c582fb388d5dcf2d7c62a5927726d900810d3722f00d057c3e937f58f7eeadb14759f388c90c4fc69befe7138a2a2c8b4f28e9
SSDEEP 1536:hbF4dPcdaCK5QPqfhVWbdsmA+RjPFLC+e5hRI0ZGUGf2g:hqdPcdaCNPqfcxA+HFshCOg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1476	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 3740	2624	9fab50f35f129bca48880cb763462c60aec5aec04fa2416392dca33352eb010c_NeikiAnalytics.exe	83
PID 2624 wrote to memory of 3740	2624	9fab50f35f129bca48880cb763462c60aec5aec04fa2416392dca33352eb010c_NeikiAnalytics.exe	83
PID 2624 wrote to memory of 3740	2624	9fab50f35f129bca48880cb763462c60aec5aec04fa2416392dca33352eb010c_NeikiAnalytics.exe	83
PID 3740 wrote to memory of 1476	3740	cmd.exe	84
PID 3740 wrote to memory of 1476	3740	cmd.exe	84
PID 3740 wrote to memory of 1476	3740	cmd.exe	84
PID 1476 wrote to memory of 2096	1476	[email protected]	85
PID 1476 wrote to memory of 2096	1476	[email protected]	85
PID 1476 wrote to memory of 2096	1476	[email protected]	85

C:\Users\Admin\AppData\Local\Temp\9fab50f35f129bca48880cb763462c60aec5aec04fa2416392dca33352eb010c_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9fab50f35f129bca48880cb763462c60aec5aec04fa2416392dca33352eb010c_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2096

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 73KB
SHA256 d2c7a3b6ef6b4797bf2a345acc40e84357ba0df9305a81710b9eae4d95264b08
MD5 10deb7e7425863bfa3ecc4dd27d6d672
SHA1 913542a68a33de2fb33dbea672bab87729535b5a
SHA512 f2d0d05270ebe60456b4b05d4843c9ee3af81fb02bf50937cdf73772bc030710d3d9ea32045d4b840afc1e261151eb73a1d4335e16b73def11d6aedd6d2ccaff
SSDEEP 1536:hbSYv9ZK5QPqfhVWbdsmA+RjPFLC+e5hLI0ZGUGf2g:hGYvHNPqfcxA+HFshMOg
MD5 SHA1 SHA512 SSDEEP

Submit Download

00.exe

Path C:\Users\Admin\AppData\Local\Temp\00.exe
Size 2KB
SHA256 bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991
MD5 7b621943a35e7f39cf89f50cc48d7b94
SHA1 2858a28cf60f38025fffcd0ba2ecfec8511c197d
SHA512 4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1
MD5 SHA1 SHA512

Submit Download

memory/1476-7-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/2624-8-0x0000000000400000-0x0000000000419000-memory.dmp

Download