8db1fb48b0f8d3786f6bf3228fc21234af266fbf13605e290e94d87f496a2216

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 10:06

Target

abddaed9d375c2fbcde662498ef37220_NeikiAnalytics.exe
Size

6.0MB
MD5

abddaed9d375c2fbcde662498ef37220
SHA1

12440f41686f38d6847a96b746f7cc756d513d7e
SHA256

8db1fb48b0f8d3786f6bf3228fc21234af266fbf13605e290e94d87f496a2216
SHA512

d94080a25685abdd0ce7eb211b8a2c9e18e2032a36952e2dd30cac991cc70e1f374fc20fe3c29c78da651a0bb3d8147d3f0f3d290826afafdb3c5f316a06a7f4
SSDEEP

98304:ykLF5Q6Sjdtw1t5cV++WNVqFBCI6VK1bfJFCLcTt29s4C1eH9n:dEpf4cV1A0bfzQct5o9n

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2096	abddaed9d375c2fbcde662498ef37220_NeikiAnalytics.tmp

Loads dropped DLL 1 IoCs

pid	Process
1888	abddaed9d375c2fbcde662498ef37220_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2096	1888	abddaed9d375c2fbcde662498ef37220_NeikiAnalytics.exe	28
PID 1888 wrote to memory of 2096	1888	abddaed9d375c2fbcde662498ef37220_NeikiAnalytics.exe	28
PID 1888 wrote to memory of 2096	1888	abddaed9d375c2fbcde662498ef37220_NeikiAnalytics.exe	28
PID 1888 wrote to memory of 2096	1888	abddaed9d375c2fbcde662498ef37220_NeikiAnalytics.exe	28
PID 1888 wrote to memory of 2096	1888	abddaed9d375c2fbcde662498ef37220_NeikiAnalytics.exe	28
PID 1888 wrote to memory of 2096	1888	abddaed9d375c2fbcde662498ef37220_NeikiAnalytics.exe	28
PID 1888 wrote to memory of 2096	1888	abddaed9d375c2fbcde662498ef37220_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\abddaed9d375c2fbcde662498ef37220_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\abddaed9d375c2fbcde662498ef37220_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Users\Admin\AppData\Local\Temp\is-FVB3A.tmp\abddaed9d375c2fbcde662498ef37220_NeikiAnalytics.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-FVB3A.tmp\abddaed9d375c2fbcde662498ef37220_NeikiAnalytics.tmp" /SL5="$5014E,5387216,832512,C:\Users\Admin\AppData\Local\Temp\abddaed9d375c2fbcde662498ef37220_NeikiAnalytics.exe"
  2⤵
  - Executes dropped EXE
  PID:2096

\Users\Admin\AppData\Local\Temp\is-FVB3A.tmp\abddaed9d375c2fbcde662498ef37220_NeikiAnalytics.tmp

Filesize
3.1MB

MD5
0f05aa51ca52698df2830318c02fe27e

SHA1
39bbb860c0d67f6ab254befba3380bfa317756cd

SHA256
2367253bffb5f2af8bf6cbffea4696ced4bd973cbcb30729e57ed26a0d76f66a

SHA512
beb98f2e1955378386fc92fb06a1402becaee7b2895cd6a5aa5927ffd3dfbf8c96e851d8438f750280269c1d10a2a85f8bb4949b3e586e2b9266eb9d6d425211

Download Submit
memory/1888-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/1888-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1888-10-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2096-9-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2096-11-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download