c90aa2c5e6105057af681bc32b93011ae8c33b9fdecbcfabdb62e60c1fdc190a

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 11:07

Target

cd69db115a609d5b3d6cfad9f8776c00_NeikiAnalytics.exe
Size

79KB
MD5

cd69db115a609d5b3d6cfad9f8776c00
SHA1

0d28917b6d13f6e5c1073c4b64072b880acb6860
SHA256

c90aa2c5e6105057af681bc32b93011ae8c33b9fdecbcfabdb62e60c1fdc190a
SHA512

0f0bd5fe4323788b85fab160877932f7b8cc5c4e1f344e4169636f5094162e6137916feef4902bbda9861f5aaf191a141b93287f074860058f1a5a279a314582
SSDEEP

1536:zvT7uOoAwg4YQn3COQA8AkqUhMb2nuy5wgIP0CSJ+5y1B8GMGlZ5G:zv+OoT3GdqU7uy5w9WMy1N5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2352	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
3036	cmd.exe
3036	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 3036	840	cd69db115a609d5b3d6cfad9f8776c00_NeikiAnalytics.exe	29
PID 840 wrote to memory of 3036	840	cd69db115a609d5b3d6cfad9f8776c00_NeikiAnalytics.exe	29
PID 840 wrote to memory of 3036	840	cd69db115a609d5b3d6cfad9f8776c00_NeikiAnalytics.exe	29
PID 840 wrote to memory of 3036	840	cd69db115a609d5b3d6cfad9f8776c00_NeikiAnalytics.exe	29
PID 3036 wrote to memory of 2352	3036	cmd.exe	30
PID 3036 wrote to memory of 2352	3036	cmd.exe	30
PID 3036 wrote to memory of 2352	3036	cmd.exe	30
PID 3036 wrote to memory of 2352	3036	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\cd69db115a609d5b3d6cfad9f8776c00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\cd69db115a609d5b3d6cfad9f8776c00_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2352

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
a98d1075112c536a86ffdbff02ec7ef7

SHA1
bffa490400e9f65a2a5b76a6a2684a6391c3badb

SHA256
8696491f68733d398b20326f41ff9e0e89b0794158887937da8da50141a91f22

SHA512
cc91ed9d7939173c34541bb7183e25712b66e77abbdd6523043dcef1413a170b1da441eed85e1dfb9cf6a087f59f4639ee095d3d619c2c59f89b7913e1f37def

Download Submit
memory/840-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2352-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download