cb87918bcfacd33cd37a95abf3c77a16ce8cb856e1a3193e8a208806e3c021fa

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 03:36

Target

5f4bc8a754c8f3d5db7a97b61519d2b0_NeikiAnalytics.exe
Size

73KB
MD5

5f4bc8a754c8f3d5db7a97b61519d2b0
SHA1

e274462a7682311878b3ef3de648600085804746
SHA256

cb87918bcfacd33cd37a95abf3c77a16ce8cb856e1a3193e8a208806e3c021fa
SHA512

7312a1fa5174af78e5fac0a6ad41f5844053aa35c50d35ad1f0f0daf9b67739b75d478c095608fac79300cd36b65cece1d0ca1c1fa8769f14fbc257bd4d1af20
SSDEEP

1536:hbHxPwDKcDXyVK5QPqfhVWbdsmA+RjPFLC+e5hw0ZGUGf2g:htP6D8NPqfcxA+HFshwOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2076	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2068	cmd.exe
2068	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2068	2932	5f4bc8a754c8f3d5db7a97b61519d2b0_NeikiAnalytics.exe	30
PID 2932 wrote to memory of 2068	2932	5f4bc8a754c8f3d5db7a97b61519d2b0_NeikiAnalytics.exe	30
PID 2932 wrote to memory of 2068	2932	5f4bc8a754c8f3d5db7a97b61519d2b0_NeikiAnalytics.exe	30
PID 2932 wrote to memory of 2068	2932	5f4bc8a754c8f3d5db7a97b61519d2b0_NeikiAnalytics.exe	30
PID 2068 wrote to memory of 2076	2068	cmd.exe	31
PID 2068 wrote to memory of 2076	2068	cmd.exe	31
PID 2068 wrote to memory of 2076	2068	cmd.exe	31
PID 2068 wrote to memory of 2076	2068	cmd.exe	31
PID 2076 wrote to memory of 2948	2076	[email protected]	32
PID 2076 wrote to memory of 2948	2076	[email protected]	32
PID 2076 wrote to memory of 2948	2076	[email protected]	32
PID 2076 wrote to memory of 2948	2076	[email protected]	32

C:\Users\Admin\AppData\Local\Temp\5f4bc8a754c8f3d5db7a97b61519d2b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5f4bc8a754c8f3d5db7a97b61519d2b0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2076
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2948

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
263b0f4d12b8e0f754af4a48d3b4cac8

SHA1
25fb32542ea2652f46d1a84e0927799d84bbcca4

SHA256
e127985b9349a50104aa97dd2057a1c73a27a98dd74d3524b83c27d4dc213e3a

SHA512
26b31ddbc762718bf4153a818d4dc2edbc80a8799e6296b2b89ab024f8cfa0a178fbe7afe98baf179a0bba1ef1fe8a3d229b18ca7fadae67dd354274d5e930a9

Download Submit
memory/2076-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2932-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download