9c7a6b2998003c304484555f8abf466afbb6eb41ca07045e9f4cd2b285707ef5

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 03:58

Target

653419bb4f788667cd95b80d86b7cab0_NeikiAnalytics.exe
Size

79KB
MD5

653419bb4f788667cd95b80d86b7cab0
SHA1

feda12c27ac15ed7aa56519e58af68eb858609ea
SHA256

9c7a6b2998003c304484555f8abf466afbb6eb41ca07045e9f4cd2b285707ef5
SHA512

728503be5844ec5f21da838e55244892e622fdd89045048adc5f56d7e7a95dbd24494443f8d47f2f7ab492ec976599464ba68019f5c6bcbaf55b56850e2b81ab
SSDEEP

1536:zvZVIhoOFZ2OQA8AkqUhMb2nuy5wgIP0CSJ+5yHB8GMGlZ5G:zvrIGO/TGdqU7uy5w9WMyHN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2500	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2980	cmd.exe
2980	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2980	2492	653419bb4f788667cd95b80d86b7cab0_NeikiAnalytics.exe	29
PID 2492 wrote to memory of 2980	2492	653419bb4f788667cd95b80d86b7cab0_NeikiAnalytics.exe	29
PID 2492 wrote to memory of 2980	2492	653419bb4f788667cd95b80d86b7cab0_NeikiAnalytics.exe	29
PID 2492 wrote to memory of 2980	2492	653419bb4f788667cd95b80d86b7cab0_NeikiAnalytics.exe	29
PID 2980 wrote to memory of 2500	2980	cmd.exe	30
PID 2980 wrote to memory of 2500	2980	cmd.exe	30
PID 2980 wrote to memory of 2500	2980	cmd.exe	30
PID 2980 wrote to memory of 2500	2980	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\653419bb4f788667cd95b80d86b7cab0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\653419bb4f788667cd95b80d86b7cab0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2500

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
2ba3d0a8e83a45bee74d6dc83b24bcbe

SHA1
832f48c5edd2a0e43a5f8dc7d872422579510539

SHA256
7aa1b319e186ae6c3116ce8f6803238affac36f869af2721cbd2de6b228014c7

SHA512
74a6ed5d87368236e303a4f759db9cfe70a01305d8fb1b6e9d0888767b57cf7649883d3351a7c5ee2e920785703f0da7e9595429a4bcea0017c596979ceb0c34

Download Submit
memory/2492-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2500-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download