5432e359e7cc4d68f327aec94864c82561692ce8b283b3df005f5d8f590256d3

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 19:30

Target

1fd1027f4511599c712d02cc01a77d60_NeikiAnalytics.exe
Size

2.9MB
MD5

1fd1027f4511599c712d02cc01a77d60
SHA1

269405d29feb9a8df54d124a5f89d4d03e262530
SHA256

5432e359e7cc4d68f327aec94864c82561692ce8b283b3df005f5d8f590256d3
SHA512

d01f9703c7a89e210176bac6c061ba3d436b884b2bffba55b6eee7d6232f636d70c075fd6b0320f7624b79a9e4489f98db5e2e6e6fb6ebc80d4f445ac8d0b1ab
SSDEEP

49152:vxhJ0eWndt484NyTj3jHzhosdCHkL+SRVtnv+affbdLoNFl3dqLqDLnOI5WsLpb:Zhm94XybqsZ+SR3nmafDdgnNMqDLn5Wg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2056	fgnbgriwqss.exe

Loads dropped DLL 1 IoCs

pid	Process
1548	1fd1027f4511599c712d02cc01a77d60_NeikiAnalytics.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\rwcxtab\fgnbgriwqss.exe	1fd1027f4511599c712d02cc01a77d60_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 2056	1548	1fd1027f4511599c712d02cc01a77d60_NeikiAnalytics.exe	28
PID 1548 wrote to memory of 2056	1548	1fd1027f4511599c712d02cc01a77d60_NeikiAnalytics.exe	28
PID 1548 wrote to memory of 2056	1548	1fd1027f4511599c712d02cc01a77d60_NeikiAnalytics.exe	28
PID 1548 wrote to memory of 2056	1548	1fd1027f4511599c712d02cc01a77d60_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\1fd1027f4511599c712d02cc01a77d60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1fd1027f4511599c712d02cc01a77d60_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Program Files (x86)\rwcxtab\fgnbgriwqss.exe
  "C:\Program Files (x86)\rwcxtab\fgnbgriwqss.exe"
  2⤵
  - Executes dropped EXE
  PID:2056

C:\Program Files (x86)\rwcxtab\fgnbgriwqss.exe

Filesize
3.0MB

MD5
ef27c6f1af22b1af0a7480a08a4f2441

SHA1
30487d90ed18871f50a6a9c95ce9591542046cf1

SHA256
0923aeccebdbd1f0169c06bf0c5cc243a371eb7dfc246fbcf330d8e30c47409d

SHA512
fb824baff66d9973b3f137bc244fafc36c06128a97df6cd85fd8f7d5a35be1438d95198b32e84d8511fc4092eca85d09ef001b82b11fbc5996bc5347c5c6e3ce

Download Submit
memory/1548-1-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1548-0-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1548-6-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2056-8-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2056-9-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2056-10-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download