8969eda503dbe8eb26a57b24b0cc25bff39035c594b6a653a02fb8a00a1269ef

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 02:00

Target

4504e015b13cd0353a7194c5439294f0_NeikiAnalytics.exe
Size

73KB
MD5

4504e015b13cd0353a7194c5439294f0
SHA1

c7f803ea5503c0ac32da424f2ec4a9047a536b8b
SHA256

8969eda503dbe8eb26a57b24b0cc25bff39035c594b6a653a02fb8a00a1269ef
SHA512

e89ff6074eda09377b23ef693017b88ee552e14063a6be93b14dc5dac0abf0c84ff272ccb0593c05c5d8c55072ebda40bcae6a7d839b11e2dbdfa07ee35e2412
SSDEEP

1536:hbXzeDY4a/DcK5QPqfhVWbdsmA+RjPFLC+e5h80ZGUGf2g:hDzeDMcNPqfcxA+HFsh8Og

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2244	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
1884	cmd.exe
1884	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 1884	2268	4504e015b13cd0353a7194c5439294f0_NeikiAnalytics.exe	29
PID 2268 wrote to memory of 1884	2268	4504e015b13cd0353a7194c5439294f0_NeikiAnalytics.exe	29
PID 2268 wrote to memory of 1884	2268	4504e015b13cd0353a7194c5439294f0_NeikiAnalytics.exe	29
PID 2268 wrote to memory of 1884	2268	4504e015b13cd0353a7194c5439294f0_NeikiAnalytics.exe	29
PID 1884 wrote to memory of 2244	1884	cmd.exe	30
PID 1884 wrote to memory of 2244	1884	cmd.exe	30
PID 1884 wrote to memory of 2244	1884	cmd.exe	30
PID 1884 wrote to memory of 2244	1884	cmd.exe	30
PID 2244 wrote to memory of 3060	2244	[email protected]	31
PID 2244 wrote to memory of 3060	2244	[email protected]	31
PID 2244 wrote to memory of 3060	2244	[email protected]	31
PID 2244 wrote to memory of 3060	2244	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\4504e015b13cd0353a7194c5439294f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4504e015b13cd0353a7194c5439294f0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2244
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:3060

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
84f8c8a61abce78043f46a913e505509

SHA1
5a989cda695454e9afaa6cfebb4c7a298cb4a620

SHA256
748e3d8d89b678d6ad2b1a448888441e761613970b26a12e940fbfdd734a5158

SHA512
539e6b8d5a42e3a9d80a6680eb2f1798eea5f9fb931b36538a1abf0adbe9ec8d8646d04533d4b6147549572fc597f115032308df9a17fee89db461c936d16808

Download Submit
memory/2244-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2268-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download