394d371523ae3cbd29fffb51951cbafcbac1a18b2da30cf586e03391e1ad8ee5

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 05:51

Target

8446cadd7dcf28069f94d9403b1f61b0_NeikiAnalytics.exe
Size

79KB
MD5

8446cadd7dcf28069f94d9403b1f61b0
SHA1

e34a0f62e8850a7e4863dbccf9a61e49c68bb4a8
SHA256

394d371523ae3cbd29fffb51951cbafcbac1a18b2da30cf586e03391e1ad8ee5
SHA512

6bfbce8779f476ebb47e9d25a64eedb56fa791c3e715e1e6e3e5c7f006b74c32e19e5b12743301113b5c39d0ad81f721ec536c81dfca2d1ad36479eba1cb70a5
SSDEEP

1536:zvEN4x70et8lZH9WOQA8AkqUhMb2nuy5wgIP0CSJ+5yBB8GMGlZ5G:zvEc7p8l7zGdqU7uy5w9WMyBN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3048	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2744	cmd.exe
2744	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2744	1516	8446cadd7dcf28069f94d9403b1f61b0_NeikiAnalytics.exe	29
PID 1516 wrote to memory of 2744	1516	8446cadd7dcf28069f94d9403b1f61b0_NeikiAnalytics.exe	29
PID 1516 wrote to memory of 2744	1516	8446cadd7dcf28069f94d9403b1f61b0_NeikiAnalytics.exe	29
PID 1516 wrote to memory of 2744	1516	8446cadd7dcf28069f94d9403b1f61b0_NeikiAnalytics.exe	29
PID 2744 wrote to memory of 3048	2744	cmd.exe	30
PID 2744 wrote to memory of 3048	2744	cmd.exe	30
PID 2744 wrote to memory of 3048	2744	cmd.exe	30
PID 2744 wrote to memory of 3048	2744	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\8446cadd7dcf28069f94d9403b1f61b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8446cadd7dcf28069f94d9403b1f61b0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:3048

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
36e414a9c5c3742226fbc60431aa77ce

SHA1
8f193c26afab0349c9721f66413d666329af3511

SHA256
364f169382103deb331a0b0b0fa99d97b85a7a686ec7e9fbb3c43e06deb6027c

SHA512
722d3ee7d91661f1de5231cfde1f947c9737c712b2fb8783719fabfbaa6ae13336d52bb05622e93a5ca27e96684898cc540596820608b88a9bd3155adf8aa4e0

Download Submit
memory/1516-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3048-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download