f5e6007f884139f3348fa38c29a2ea8b5a83edc40e16db0b325f5e651efb98cb

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 22:22

Target

0f060db83e2d61c424a91aefde239f20_NeikiAnalytics.exe
Size

79KB
MD5

0f060db83e2d61c424a91aefde239f20
SHA1

1d73deb7e51bf93ade0cf8175a5e0e08056c0d69
SHA256

f5e6007f884139f3348fa38c29a2ea8b5a83edc40e16db0b325f5e651efb98cb
SHA512

bc1c6e0371e7fc06ed6c58618bdcb22652d269f57a5563b59c6be22fdfece9a5aab8a315ce9868fea42ba930487de047341f780cfb4eb77cd0faef031aa8a18e
SSDEEP

1536:zvBhcIFGoQftrSOQA8AkqUhMb2nuy5wgIP0CSJ+5ylB8GMGlZ5G:zvqrXGdqU7uy5w9WMylN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2680	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
3004	cmd.exe
3004	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 3004	1368	0f060db83e2d61c424a91aefde239f20_NeikiAnalytics.exe	29
PID 1368 wrote to memory of 3004	1368	0f060db83e2d61c424a91aefde239f20_NeikiAnalytics.exe	29
PID 1368 wrote to memory of 3004	1368	0f060db83e2d61c424a91aefde239f20_NeikiAnalytics.exe	29
PID 1368 wrote to memory of 3004	1368	0f060db83e2d61c424a91aefde239f20_NeikiAnalytics.exe	29
PID 3004 wrote to memory of 2680	3004	cmd.exe	30
PID 3004 wrote to memory of 2680	3004	cmd.exe	30
PID 3004 wrote to memory of 2680	3004	cmd.exe	30
PID 3004 wrote to memory of 2680	3004	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\0f060db83e2d61c424a91aefde239f20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0f060db83e2d61c424a91aefde239f20_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2680

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
e09c98d5b22d6bb5e2146bf4d41cc60d

SHA1
4759c7d807182921bb4226f8e8259af0a004618d

SHA256
81c88a967b8c0b26ba5f72d42cb472746ed5671917b699ec8a40206d0b8e3fd4

SHA512
9f2b1236ed69e59765f13bb54b39d1722366f41373a999fc96909502d04ed4bc0ae7ad42a7c28deeab9f3090aac6bde4982e06340f29fefe64a8408a5db46285

Download Submit
memory/1368-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2680-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download