f87fd136e54b8f1b4974959a4e7e7d8171897fcd3e77c9ad8c7aaafb1a5dc34f

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 04:18

Target

6a6f20158d517536da551f000f1e43d0_NeikiAnalytics.exe
Size

73KB
MD5

6a6f20158d517536da551f000f1e43d0
SHA1

8d2b85ae3e03cff1608c69d4eefc992cf84de3c3
SHA256

f87fd136e54b8f1b4974959a4e7e7d8171897fcd3e77c9ad8c7aaafb1a5dc34f
SHA512

b7576c69ac0e404364546cc8fb2336389c3a03b5579752c4ecb716fb6df4b7fbc99f74b3901016cc52abe44d3b5d9853864274a24166f0b6728336dcd0e6c756
SSDEEP

1536:hbS7jwHOIGK5QPqfhVWbdsmA+RjPFLC+e5hhHQ0ZGUGf2g:h4jpVNPqfcxA+HFshhwOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2732	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
1624	cmd.exe
1624	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1624	2188	6a6f20158d517536da551f000f1e43d0_NeikiAnalytics.exe	29
PID 2188 wrote to memory of 1624	2188	6a6f20158d517536da551f000f1e43d0_NeikiAnalytics.exe	29
PID 2188 wrote to memory of 1624	2188	6a6f20158d517536da551f000f1e43d0_NeikiAnalytics.exe	29
PID 2188 wrote to memory of 1624	2188	6a6f20158d517536da551f000f1e43d0_NeikiAnalytics.exe	29
PID 1624 wrote to memory of 2732	1624	cmd.exe	30
PID 1624 wrote to memory of 2732	1624	cmd.exe	30
PID 1624 wrote to memory of 2732	1624	cmd.exe	30
PID 1624 wrote to memory of 2732	1624	cmd.exe	30
PID 2732 wrote to memory of 2040	2732	[email protected]	31
PID 2732 wrote to memory of 2040	2732	[email protected]	31
PID 2732 wrote to memory of 2040	2732	[email protected]	31
PID 2732 wrote to memory of 2040	2732	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\6a6f20158d517536da551f000f1e43d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6a6f20158d517536da551f000f1e43d0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2040

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
8e4b4a87432046d5e7a4f4af0ca75b2b

SHA1
88e02ad4320cea87defe8231d824999938c850a8

SHA256
85d677dd14b0ef69c14370c2ad9cb6edf7439c284c44c6b31389a2cc30368f83

SHA512
0184f7ee302114cee72a8ffb213eafa22ea557eb25d45c001a25cb51702068a78de02ffe25eb381969681619d99a9ff3987ee905369741cbc1072de27da613ce

Download Submit
memory/2188-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2732-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download