1110aa48930bbe5c554db24aef41373a615a11f594aec785a5c087cdc4a3c656

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 00:05

Target

60459877f1db91d5fdc7c8c418daba80_NeikiAnalytics.exe
Size

79KB
MD5

60459877f1db91d5fdc7c8c418daba80
SHA1

1d3f840f5ae1f7bd9d434f1ada71b20c1eab2e8e
SHA256

1110aa48930bbe5c554db24aef41373a615a11f594aec785a5c087cdc4a3c656
SHA512

790b378019cf9c46382cfc6d69391a16ccb36d8150ea2112b2701f4a416a50ad5a8e28d841aef35c38246772a18155972bc8545f77f282451c3a490a6c3bc272
SSDEEP

1536:zvqdANke+cTyY27OQA8AkqUhMb2nuy5wgIP0CSJ+5y8B8GMGlZ5G:zvqSye+ElGdqU7uy5w9WMy8N5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2248	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2288	cmd.exe
2288	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2288	1636	60459877f1db91d5fdc7c8c418daba80_NeikiAnalytics.exe	29
PID 1636 wrote to memory of 2288	1636	60459877f1db91d5fdc7c8c418daba80_NeikiAnalytics.exe	29
PID 1636 wrote to memory of 2288	1636	60459877f1db91d5fdc7c8c418daba80_NeikiAnalytics.exe	29
PID 1636 wrote to memory of 2288	1636	60459877f1db91d5fdc7c8c418daba80_NeikiAnalytics.exe	29
PID 2288 wrote to memory of 2248	2288	cmd.exe	30
PID 2288 wrote to memory of 2248	2288	cmd.exe	30
PID 2288 wrote to memory of 2248	2288	cmd.exe	30
PID 2288 wrote to memory of 2248	2288	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\60459877f1db91d5fdc7c8c418daba80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\60459877f1db91d5fdc7c8c418daba80_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2248

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
89333906f6f83a758babc552239d0e7b

SHA1
1365fe72a8035705c34fbc271f4251c78cba86af

SHA256
ca10cdcf17e37a332015eddec68cea3e0208b00ad494c98668e0e15879a14fec

SHA512
df233ce84b14202ce81b758a788c4fd16200acd924d207e4ea646ecd9817b486ddb26dc9454f4ee4b9e22583fcaa67470ed0cdb7c774f9ed6b61560c09d0ea27

Download Submit
memory/1636-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2248-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download