6895a6e9e8c314b03a1db7c19f03f4816992a614313869b4079f33d6915e02d5

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 17:18

Target

2e56f103fa417d2f8069b203c951b8d0_NeikiAnalytics.exe
Size

73KB
MD5

2e56f103fa417d2f8069b203c951b8d0
SHA1

38591267591c94a0cc05e0413c307e3beee05f5b
SHA256

6895a6e9e8c314b03a1db7c19f03f4816992a614313869b4079f33d6915e02d5
SHA512

42e28a738caa5616c8ad71c36d82be7e3ac4bf7744028d8a066f0fb59e4d58df5c3d4b38477e42b7a821c2dbb3d063b2af739d57c13c5018eeda107d3289f046
SSDEEP

1536:hbZgPaa0RNK5QPqfhVWbdsmA+RjPFLC+e5hr0ZGUGf2g:hNgeRNNPqfcxA+HFshrOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2784	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2224	cmd.exe
2224	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2224	2888	2e56f103fa417d2f8069b203c951b8d0_NeikiAnalytics.exe	29
PID 2888 wrote to memory of 2224	2888	2e56f103fa417d2f8069b203c951b8d0_NeikiAnalytics.exe	29
PID 2888 wrote to memory of 2224	2888	2e56f103fa417d2f8069b203c951b8d0_NeikiAnalytics.exe	29
PID 2888 wrote to memory of 2224	2888	2e56f103fa417d2f8069b203c951b8d0_NeikiAnalytics.exe	29
PID 2224 wrote to memory of 2784	2224	cmd.exe	30
PID 2224 wrote to memory of 2784	2224	cmd.exe	30
PID 2224 wrote to memory of 2784	2224	cmd.exe	30
PID 2224 wrote to memory of 2784	2224	cmd.exe	30
PID 2784 wrote to memory of 3024	2784	[email protected]	31
PID 2784 wrote to memory of 3024	2784	[email protected]	31
PID 2784 wrote to memory of 3024	2784	[email protected]	31
PID 2784 wrote to memory of 3024	2784	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\2e56f103fa417d2f8069b203c951b8d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2e56f103fa417d2f8069b203c951b8d0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:3024

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
29dc2c3839ab40d0e022240707d605dc

SHA1
1d8b7dbd5facf4140454886e268211721622cc00

SHA256
6d3b29dd729b890de32c140ce263e44e3a189eabd5a40f42dce73439ad694901

SHA512
2f47a7b952432582b1853f44c8a500a8ae09424c4b7d9acb8c680b776f1869e411414592975870f710942d33846d45ec626428a0c6434fa609cdc947643b4eb2

Download Submit
memory/2784-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2888-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download