689ec277242e48b5eb63e693b95750edef515248be06cbb457781f5ef8ae1452

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 13:03

Target

e8e56821baf7ee364094aa04aeef35a0_NeikiAnalytics.exe
Size

79KB
MD5

e8e56821baf7ee364094aa04aeef35a0
SHA1

7d399c2af9b0bac35829f2298a17f82a89e2eba1
SHA256

689ec277242e48b5eb63e693b95750edef515248be06cbb457781f5ef8ae1452
SHA512

2f9aa48f2379de7011620bb3a74888c6460a1a7ce7d8943903d978c3c3b9bb6b1c2cf8cf9556d1014ece0099866b09a0d0959b0ab6bdbe8f4836ba5cc5034b8d
SSDEEP

1536:zvQFxWrhuqoWnMxOQA8AkqUhMb2nuy5wgIP0CSJ+5yTB8GMGlZ5G:zvQFx/0MAGdqU7uy5w9WMyTN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3064	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2956	cmd.exe
2956	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2956	2944	e8e56821baf7ee364094aa04aeef35a0_NeikiAnalytics.exe	29
PID 2944 wrote to memory of 2956	2944	e8e56821baf7ee364094aa04aeef35a0_NeikiAnalytics.exe	29
PID 2944 wrote to memory of 2956	2944	e8e56821baf7ee364094aa04aeef35a0_NeikiAnalytics.exe	29
PID 2944 wrote to memory of 2956	2944	e8e56821baf7ee364094aa04aeef35a0_NeikiAnalytics.exe	29
PID 2956 wrote to memory of 3064	2956	cmd.exe	30
PID 2956 wrote to memory of 3064	2956	cmd.exe	30
PID 2956 wrote to memory of 3064	2956	cmd.exe	30
PID 2956 wrote to memory of 3064	2956	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\e8e56821baf7ee364094aa04aeef35a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e8e56821baf7ee364094aa04aeef35a0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:3064

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
ab2ca91b90e67c98159b1c340a0566ca

SHA1
a9efcead7efd79578b91840e93d9cac85cdda339

SHA256
d101174d44d55a4e11a2f099c365eb7f9d11f454411b65521be93deb7488dac5

SHA512
72ed1b3309316a156016516b829b283b3ba8e1ef08c1917065b3cbf20a09bdd06af3a77bd0d706b2181149635da730a780fe86dec974476446ad3812dccc6269

Download Submit
memory/2944-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3064-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download