899031d42b1616461c9803537b7a8c0805a89fdf625215798f936ece4afb6324

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 07:18

Target

9ccd740b6166b5611432c8965fdafff0_NeikiAnalytics.exe
Size

1.2MB
MD5

9ccd740b6166b5611432c8965fdafff0
SHA1

d98fd0d6a1dc995c6b64ecae41544a4e4b67569d
SHA256

899031d42b1616461c9803537b7a8c0805a89fdf625215798f936ece4afb6324
SHA512

7e9a5365126b2a0ad64439f81ec7f84c80d8874a88e1290c97bdd54211cc966550df431f55f21b18ba244a2effb9d1082aee79f0fcba29ced15c55dcf6ad2b66
SSDEEP

24576:tDjcuwP9Ryj2oADDK06cs964JsGXuZlXn+Evi:xcu0yfAvK0Kl1XenNv

Score

1^/10

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 996	2128	9ccd740b6166b5611432c8965fdafff0_NeikiAnalytics.exe	29
PID 2128 wrote to memory of 996	2128	9ccd740b6166b5611432c8965fdafff0_NeikiAnalytics.exe	29
PID 2128 wrote to memory of 996	2128	9ccd740b6166b5611432c8965fdafff0_NeikiAnalytics.exe	29
PID 2128 wrote to memory of 1792	2128	9ccd740b6166b5611432c8965fdafff0_NeikiAnalytics.exe	30
PID 2128 wrote to memory of 1792	2128	9ccd740b6166b5611432c8965fdafff0_NeikiAnalytics.exe	30
PID 2128 wrote to memory of 1792	2128	9ccd740b6166b5611432c8965fdafff0_NeikiAnalytics.exe	30
PID 2128 wrote to memory of 1192	2128	9ccd740b6166b5611432c8965fdafff0_NeikiAnalytics.exe	32
PID 2128 wrote to memory of 1192	2128	9ccd740b6166b5611432c8965fdafff0_NeikiAnalytics.exe	32
PID 2128 wrote to memory of 1192	2128	9ccd740b6166b5611432c8965fdafff0_NeikiAnalytics.exe	32

C:\Users\Admin\AppData\Local\Temp\9ccd740b6166b5611432c8965fdafff0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9ccd740b6166b5611432c8965fdafff0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:996
- C:\Windows\system32\cmd.exe
  cmd /c cd C:\Users\Admin\AppData\Roaming\Orbit && DisableVulnerableDriverList.reg && exit
  2⤵
  PID:1792
- C:\Windows\system32\cmd.exe
  cmd /c cd C:\Users\Admin\AppData\Roaming\Orbit && DisableHypervisorEnforcedCodeIntegrity.reg && exit
  2⤵
  PID:1192