ec02ebcb7d7db688fb310c13e0499022d1af16494473701b76b2823823fe1794

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 18:07

Target

14c06ee9713bbb3338f3191b06790a80_NeikiAnalytics.exe
Size

34KB
MD5

14c06ee9713bbb3338f3191b06790a80
SHA1

420694ed8b710c7c344d54de7e4d882ca8e92d8f
SHA256

ec02ebcb7d7db688fb310c13e0499022d1af16494473701b76b2823823fe1794
SHA512

99f435ab2b25b4bb213ff912cd0e75657037fbfab4a8ce21e371cd025e9197a8e1330174ef5743ce9a4acec4db50cb336df6c0d5cc2890e7046c21bb709f60b6
SSDEEP

768:q+Q2XLPfsUqTlTbxzOmJQqO3VhDWiNl2bp6o:HPUUqxomJQqO3VhDWiyD

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2164	hhcbrnaff.exe

Loads dropped DLL 1 IoCs

pid	Process
2320	14c06ee9713bbb3338f3191b06790a80_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2164	2320	14c06ee9713bbb3338f3191b06790a80_NeikiAnalytics.exe	28
PID 2320 wrote to memory of 2164	2320	14c06ee9713bbb3338f3191b06790a80_NeikiAnalytics.exe	28
PID 2320 wrote to memory of 2164	2320	14c06ee9713bbb3338f3191b06790a80_NeikiAnalytics.exe	28
PID 2320 wrote to memory of 2164	2320	14c06ee9713bbb3338f3191b06790a80_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\14c06ee9713bbb3338f3191b06790a80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\14c06ee9713bbb3338f3191b06790a80_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe
  "C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe"
  2⤵
  - Executes dropped EXE
  PID:2164

\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe

Filesize
34KB

MD5
33aa8b154a371ea3d9e3b3d860a5ebb9

SHA1
5d35c707702253d9b43aa5f1160543a5e62e2d64

SHA256
d2d76d61fa3f2707915f5b12d8d08bb02812a6862284c19cce63540ea3893384

SHA512
365ab8af55237961d0e8a1525c4c188869cbe3a4d13259248a3b4308d6b70cd42af4a04a2970ef918a496e502b035716f30d74045fe261ece7d29d6a0b7a5b70

Download Submit
memory/2164-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2164-16-0x0000000001F20000-0x0000000002320000-memory.dmp

Filesize
4.0MB

Download
memory/2320-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2320-1-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2320-3-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2320-11-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2320-9-0x00000000003E0000-0x00000000003E9000-memory.dmp

Filesize
36KB

Download
memory/2320-5-0x00000000020B0000-0x00000000024B0000-memory.dmp

Filesize
4.0MB

Download