f09c75cc45754ca7cd62882bef61cfd4cf93b0991cf35df2b720e6127e60a424

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 14:52

Target

067af59488614698e5c1ea740b9c4e90_NeikiAnalytics.exe
Size

79KB
MD5

067af59488614698e5c1ea740b9c4e90
SHA1

da6266bf34f9d7425337a88cb67b17814ff187ed
SHA256

f09c75cc45754ca7cd62882bef61cfd4cf93b0991cf35df2b720e6127e60a424
SHA512

5a55cea36d9355069cef570574883e2e397d2f9e35bab3aebd632df351478310e54943027e602abca60e7ed141a04bbe4532478ec31b64b6b9d34806af029695
SSDEEP

1536:zvkUugKOznTotoDadOQA8AkqUhMb2nuy5wgIP0CSJ+5yvB8GMGlZ5G:zvJuVtfEGdqU7uy5w9WMyvN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2024	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
852	cmd.exe
852	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 852	1884	067af59488614698e5c1ea740b9c4e90_NeikiAnalytics.exe	29
PID 1884 wrote to memory of 852	1884	067af59488614698e5c1ea740b9c4e90_NeikiAnalytics.exe	29
PID 1884 wrote to memory of 852	1884	067af59488614698e5c1ea740b9c4e90_NeikiAnalytics.exe	29
PID 1884 wrote to memory of 852	1884	067af59488614698e5c1ea740b9c4e90_NeikiAnalytics.exe	29
PID 852 wrote to memory of 2024	852	cmd.exe	30
PID 852 wrote to memory of 2024	852	cmd.exe	30
PID 852 wrote to memory of 2024	852	cmd.exe	30
PID 852 wrote to memory of 2024	852	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\067af59488614698e5c1ea740b9c4e90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\067af59488614698e5c1ea740b9c4e90_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:852
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2024

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
6740951b4b73669ddd56dc388a5ebe12

SHA1
fcd592de0ae2e61804a87b8be844655f0fb40bc0

SHA256
d8e6368422ce988c577a20e34f8bdb6b4f786b7ca51fca5fec074f09d7c56517

SHA512
c9b18305de88ee7dfd61030c5921ea278e5e8faff8770a8636ea79c98f169995531bf8f8c8bfd693012539b870b1af6dea73fb6a64d5ea2ce29870e144d5bbc2

Download Submit
memory/1884-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2024-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download