d49d6eeb8d5993b308cfbb3cf14ef93ee4053aa914bfec40ae048828f7bd0139

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 02:56

Target

54dc0dfed4404a14904708dcd7ac0a40_NeikiAnalytics.exe
Size

78KB
MD5

54dc0dfed4404a14904708dcd7ac0a40
SHA1

7dc515ce73518d4f485ef0053dd0a696c292127c
SHA256

d49d6eeb8d5993b308cfbb3cf14ef93ee4053aa914bfec40ae048828f7bd0139
SHA512

a37875ea18b5979f6b72c17491f9f95fdbc3f0a898cfab1466ac5678b8b02e74fca05109494cf0be83578d93e3f538000e4b69e61a0f427747e658b9559908bc
SSDEEP

768:tCru/f9Iw/E6zy4n8uZZtUXMJ+fROUmELY2glEbM3j+rd+fpRiTWNReOO5Cru/fA:d1Tzy48uXtU8fOMEI3jyYfPiuOBA

Score

1^/10

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2168	1288	54dc0dfed4404a14904708dcd7ac0a40_NeikiAnalytics.exe	29
PID 1288 wrote to memory of 2168	1288	54dc0dfed4404a14904708dcd7ac0a40_NeikiAnalytics.exe	29
PID 1288 wrote to memory of 2168	1288	54dc0dfed4404a14904708dcd7ac0a40_NeikiAnalytics.exe	29
PID 1288 wrote to memory of 2168	1288	54dc0dfed4404a14904708dcd7ac0a40_NeikiAnalytics.exe	29
PID 2168 wrote to memory of 2584	2168	cmd.exe	30
PID 2168 wrote to memory of 2584	2168	cmd.exe	30
PID 2168 wrote to memory of 2584	2168	cmd.exe	30
PID 2168 wrote to memory of 2584	2168	cmd.exe	30
PID 2584 wrote to memory of 2640	2584	iexpress.exe	31
PID 2584 wrote to memory of 2640	2584	iexpress.exe	31
PID 2584 wrote to memory of 2640	2584	iexpress.exe	31
PID 2584 wrote to memory of 2640	2584	iexpress.exe	31

C:\Users\Admin\AppData\Local\Temp\54dc0dfed4404a14904708dcd7ac0a40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\54dc0dfed4404a14904708dcd7ac0a40_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\1111.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\54dc0dfed4404a14904708dcd7ac0a40_NeikiAnalytics.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\SysWOW64\iexpress.exe
    iexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2584
  - - C:\Windows\SysWOW64\makecab.exe
      C:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"
      4⤵
      PID:2640

C:\Users\Admin\AppData\Local\Temp\1111.tmp\1.bat

Filesize
1KB

MD5
02dba5f37067292355c6d01a57d4ef48

SHA1
7c67ab3f99fbf7a53018dd295d2968c525db83d9

SHA256
8b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242

SHA512
12201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a

Download Submit
C:\Users\Admin\AppData\Local\Temp\popup.sed

Filesize
79KB

MD5
c1ffa28b23b35da2827aec405412cd3c

SHA1
cdfe90110fc55b8a7ef4e5b927631435b6e3cf8a

SHA256
6ecf43ceebbda380fef3740695841da9f15a592c17421793b7ed34f3462281a3

SHA512
5db0a89cb72c227f97b810ac576a7334eff35fdc6b9effa0a29e87eb44ed7297c9392a11b4be71c3bdd3a1f0d2aaa8fa27173b527eaddeb55be351d72ad5ead1

Download Submit
C:\Users\Admin\AppData\Local\Temp\~%TargetName%.DDF

Filesize
724B

MD5
c3ca008abd6997c4b036a7e8be75cb2c

SHA1
05f7a3527bb04c691b08f040f562582035398829

SHA256
29ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3

SHA512
bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083

Download Submit
memory/1288-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1288-17-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download