07bdecc098be304d0da51db7e959277f76d71f1e39e165f9cab47301dbe92a96

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 04:32

Target

6e68d924653e9f0c315f3dab97f57670_NeikiAnalytics.exe
Size

73KB
MD5

6e68d924653e9f0c315f3dab97f57670
SHA1

928d4a46c3802951f08d5a06159a46750364165d
SHA256

07bdecc098be304d0da51db7e959277f76d71f1e39e165f9cab47301dbe92a96
SHA512

a56712c5e9e5b6532f1625dedf238f1e4002ed9bc49a2a7facf18acaf4f73b0246d759686ee7b21f47ac41b44d1abd3de5d9c2eb390e85615c537ea4ea076fe7
SSDEEP

1536:hbcXhCvalcXK5QPqfhVWbdsmA+RjPFLC+e5hvT0ZGUGf2g:hnNPqfcxA+HFshvTOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2932	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2708	cmd.exe
2708	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 2708	1364	6e68d924653e9f0c315f3dab97f57670_NeikiAnalytics.exe	29
PID 1364 wrote to memory of 2708	1364	6e68d924653e9f0c315f3dab97f57670_NeikiAnalytics.exe	29
PID 1364 wrote to memory of 2708	1364	6e68d924653e9f0c315f3dab97f57670_NeikiAnalytics.exe	29
PID 1364 wrote to memory of 2708	1364	6e68d924653e9f0c315f3dab97f57670_NeikiAnalytics.exe	29
PID 2708 wrote to memory of 2932	2708	cmd.exe	30
PID 2708 wrote to memory of 2932	2708	cmd.exe	30
PID 2708 wrote to memory of 2932	2708	cmd.exe	30
PID 2708 wrote to memory of 2932	2708	cmd.exe	30
PID 2932 wrote to memory of 2852	2932	[email protected]	31
PID 2932 wrote to memory of 2852	2932	[email protected]	31
PID 2932 wrote to memory of 2852	2932	[email protected]	31
PID 2932 wrote to memory of 2852	2932	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\6e68d924653e9f0c315f3dab97f57670_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6e68d924653e9f0c315f3dab97f57670_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2932
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2852

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
665f6e00bc604d6aa1c042b5db8e4003

SHA1
75d0dfaccf66ad42bca7960d9cb1015a2d924a7e

SHA256
0af4c45d81854ba84bed316efbdb5092ea62ba93b85bc8857bd52a14d7e5bfb3

SHA512
aeb60b3a2ad427392b303dd41f98ceb80da05ed610426c3d52ff48d965dfb6a9d20d8b07fc7b22753386d23f5cb22eef0b89937268e739b3f6233af985af395f

Download Submit
memory/1364-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2932-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download