009cf6d510966bf6b3b564f88823a00674a103ead6870ea428f7bea103a32fe5

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 10:55

Target

ca1bee1cb2d58a1ebc9d488d73493050_NeikiAnalytics.exe
Size

79KB
MD5

ca1bee1cb2d58a1ebc9d488d73493050
SHA1

ba29d820ede0b161713b5f62c9f0baf33a9e4b39
SHA256

009cf6d510966bf6b3b564f88823a00674a103ead6870ea428f7bea103a32fe5
SHA512

fa7057bbcf8f42346c0a118e6e8d13c61f41698a4ece9be50a00a51f22e44234cfe3065e91b3a41ad45839ad30ab7a9e27019e8137041203caa19682cc1c5235
SSDEEP

1536:zv61XZa5TE6RTSunOQA8AkqUhMb2nuy5wgIP0CSJ+5yPB8GMGlZ5G:zv6Ta5A6RAGdqU7uy5w9WMyPN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1724	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2808	cmd.exe
2808	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2808	2136	ca1bee1cb2d58a1ebc9d488d73493050_NeikiAnalytics.exe	29
PID 2136 wrote to memory of 2808	2136	ca1bee1cb2d58a1ebc9d488d73493050_NeikiAnalytics.exe	29
PID 2136 wrote to memory of 2808	2136	ca1bee1cb2d58a1ebc9d488d73493050_NeikiAnalytics.exe	29
PID 2136 wrote to memory of 2808	2136	ca1bee1cb2d58a1ebc9d488d73493050_NeikiAnalytics.exe	29
PID 2808 wrote to memory of 1724	2808	cmd.exe	30
PID 2808 wrote to memory of 1724	2808	cmd.exe	30
PID 2808 wrote to memory of 1724	2808	cmd.exe	30
PID 2808 wrote to memory of 1724	2808	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\ca1bee1cb2d58a1ebc9d488d73493050_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ca1bee1cb2d58a1ebc9d488d73493050_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:1724

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
5d7f0655e79e43a66f903c5022dabe8e

SHA1
4dd0c58b400b8dc99421582fe101d739c980e1c4

SHA256
039a9e98d1cae50f56f70471dd4a20b8a0f73392412d33542ee798c5c6ab9193

SHA512
18249a4d821a81dc4bcca9a72063276d6170072b63048add172eef58d82b9005145b86ed789dc86c0dcc93258da043db167f05fb68dc236c41684f4edec1a959

Download Submit
memory/1724-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2136-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download