bdc82cb38b1a2c326c0a77f8622e152f4389329111063a29512df75035c1e4fa

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 04:58

Target

76298469dc1faa1b93d424df3dc60180_NeikiAnalytics.exe
Size

79KB
MD5

76298469dc1faa1b93d424df3dc60180
SHA1

9a9273eed0b9d3d86fadf305d2fa3ad33860ee2e
SHA256

bdc82cb38b1a2c326c0a77f8622e152f4389329111063a29512df75035c1e4fa
SHA512

c7099303ec3c34ae115cf63b5c80860869591a10b24d17eccf246fdb7f6ae1762977a97018dec8bd9c88dcc72d9193026483a6e19aedef6003a6490effc8108d
SSDEEP

1536:zv5cWytItg2ofHVNz8rsOQA8AkqUhMb2nuy5wgIP0CSJ+5yEB8GMGlZ5G:zvWeu2vGdqU7uy5w9WMyEN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2972	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2920	cmd.exe
2920	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2920	1964	76298469dc1faa1b93d424df3dc60180_NeikiAnalytics.exe	29
PID 1964 wrote to memory of 2920	1964	76298469dc1faa1b93d424df3dc60180_NeikiAnalytics.exe	29
PID 1964 wrote to memory of 2920	1964	76298469dc1faa1b93d424df3dc60180_NeikiAnalytics.exe	29
PID 1964 wrote to memory of 2920	1964	76298469dc1faa1b93d424df3dc60180_NeikiAnalytics.exe	29
PID 2920 wrote to memory of 2972	2920	cmd.exe	30
PID 2920 wrote to memory of 2972	2920	cmd.exe	30
PID 2920 wrote to memory of 2972	2920	cmd.exe	30
PID 2920 wrote to memory of 2972	2920	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\76298469dc1faa1b93d424df3dc60180_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\76298469dc1faa1b93d424df3dc60180_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2972

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
cd1c4bcf7adda32798865fdd0d5c58de

SHA1
f28cb630fce73f8c354b6a080719634635c5701c

SHA256
90258cd731eacbd76e5fe7e40fa0b031f7431ee6a1b3a19a33a197acf2c5cb9b

SHA512
3337209d6f9833fb0d0a91ccf721e0281e9e13401eae13f315a88ae794611d1a3fa35c3301f53971ca79e6f6cbcb0e5c26e0f15c9bec8ec669ee105f4ec84a13

Download Submit
memory/1964-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2972-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download