e74760010823be0c01984920018c7c129fbdd65dba1a5e759b5d4508d460ff7a

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 03:39

Target

602a25f5ea1142d00e0d0e1be5a17c30_NeikiAnalytics.exe
Size

73KB
MD5

602a25f5ea1142d00e0d0e1be5a17c30
SHA1

55f003c71c5c6b0b8da2af526e95de8aaf16f527
SHA256

e74760010823be0c01984920018c7c129fbdd65dba1a5e759b5d4508d460ff7a
SHA512

6b57de5f5425b65fc70c2cb3684b79b0dafdae103fbb08807f85e660a899226c9d05509efabe7c61609f1f3d59a624a81f7d7fa1dffb71058cf1297992cdecb4
SSDEEP

1536:hbmlnULv4K5QPqfhVWbdsmA+RjPFLC+e5hR0ZGUGf2g:hyNPqfcxA+HFshROg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2280	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
1800	cmd.exe
1800	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 1800	2612	602a25f5ea1142d00e0d0e1be5a17c30_NeikiAnalytics.exe	29
PID 2612 wrote to memory of 1800	2612	602a25f5ea1142d00e0d0e1be5a17c30_NeikiAnalytics.exe	29
PID 2612 wrote to memory of 1800	2612	602a25f5ea1142d00e0d0e1be5a17c30_NeikiAnalytics.exe	29
PID 2612 wrote to memory of 1800	2612	602a25f5ea1142d00e0d0e1be5a17c30_NeikiAnalytics.exe	29
PID 1800 wrote to memory of 2280	1800	cmd.exe	30
PID 1800 wrote to memory of 2280	1800	cmd.exe	30
PID 1800 wrote to memory of 2280	1800	cmd.exe	30
PID 1800 wrote to memory of 2280	1800	cmd.exe	30
PID 2280 wrote to memory of 1184	2280	[email protected]	31
PID 2280 wrote to memory of 1184	2280	[email protected]	31
PID 2280 wrote to memory of 1184	2280	[email protected]	31
PID 2280 wrote to memory of 1184	2280	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\602a25f5ea1142d00e0d0e1be5a17c30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\602a25f5ea1142d00e0d0e1be5a17c30_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2280
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:1184

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
0a41a4626e89ccbb703d0a7e47e15769

SHA1
6132502ab4a1a9a77dc569e7fb5fbe977c187dba

SHA256
c500457c7d1e49bd3c9de09ffd72a9f29e0b76a85983bb076353b9af8ad8002a

SHA512
e7709399160ad5247ff77cb420b46ce5f281e36cd7cac289c4610dda85e1fd7f714daa9bafa7f01ba02bf723cc3771823a205decbb895a834a87954561b6f37a

Download Submit
memory/2280-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2612-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download