460ea46182036e6f5a415ada23bb3172d83d36b8047e024a450c14571ededfa4

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 11:07

Target

af1d314242e109be65398326d7397020_NeikiAnalytics.exe
Size

79KB
MD5

af1d314242e109be65398326d7397020
SHA1

079a1bec902d0e2d88587d89ae183a16ba69be75
SHA256

460ea46182036e6f5a415ada23bb3172d83d36b8047e024a450c14571ededfa4
SHA512

7b417464fef7775f2ec646b70f7721adbd4f057e0ee9adfc09ebc03d19deeb9b420f4f360e88790537ca66e2893e0238d8b7d0def85bb74c9d765b09d38518dc
SSDEEP

1536:zvUdgeKieKRKpOQA8AkqUhMb2nuy5wgIP0CSJ+5yfhB8GMGlZ5G:zvUueKKRKoGdqU7uy5w9WMyJN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2384	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2396	cmd.exe
2396	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2396	2236	af1d314242e109be65398326d7397020_NeikiAnalytics.exe	29
PID 2236 wrote to memory of 2396	2236	af1d314242e109be65398326d7397020_NeikiAnalytics.exe	29
PID 2236 wrote to memory of 2396	2236	af1d314242e109be65398326d7397020_NeikiAnalytics.exe	29
PID 2236 wrote to memory of 2396	2236	af1d314242e109be65398326d7397020_NeikiAnalytics.exe	29
PID 2396 wrote to memory of 2384	2396	cmd.exe	30
PID 2396 wrote to memory of 2384	2396	cmd.exe	30
PID 2396 wrote to memory of 2384	2396	cmd.exe	30
PID 2396 wrote to memory of 2384	2396	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\af1d314242e109be65398326d7397020_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\af1d314242e109be65398326d7397020_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2384

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
a220c463a77dd7b3b097f0a95e19c5f6

SHA1
fdaa2347114a8c1098732ee6d2e6f30eafc3a2eb

SHA256
e3010ddcce64e785a15c1dc260196a836b26a0202a6e46d61bfa3e9d986adde4

SHA512
5e35aba7b106f990a47892a7309c3aabec4255c2d5989ff498bdccc99425a3ef0a234384b1f357051af13b2a1387b0517c758521c66111e575e8ad76552f5b54

Download Submit
memory/2236-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2384-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download