e54051efc211300a9f1600087cfe1b4e6a1e7b717fe1ccb6ee80f47db1c7a4c3

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:01

Target

abde50003c72d01fb298231904a85950_NeikiAnalytics.exe
Size

79KB
MD5

abde50003c72d01fb298231904a85950
SHA1

5c3a74b266c748922d976bf585354f2cbd8942cd
SHA256

e54051efc211300a9f1600087cfe1b4e6a1e7b717fe1ccb6ee80f47db1c7a4c3
SHA512

6a32712016df8b1262de11b04899b95825d08cc2bc18b8fdfdcb1a5b18b55949e74a801961baaacb865f816adb618124fd6b440a95bcea49b65c6dc064fdc62f
SSDEEP

1536:zvQFxWrhuqoWnMxOQA8AkqUhMb2nuy5wgIP0CSJ+5ywB8GMGlZ5G:zvQFx/0MAGdqU7uy5w9WMywN5G

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

[email protected]

pid process

2280 [email protected]
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

2260 cmd.exe
2260 cmd.exe

pid	process
2280	[email protected]

pid	process
2260	cmd.exe
2260	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

abde50003c72d01fb298231904a85950_NeikiAnalytics.execmd.exe

description	pid	process	target process
PID 2208 wrote to memory of 2260	2208	abde50003c72d01fb298231904a85950_NeikiAnalytics.exe	cmd.exe
PID 2208 wrote to memory of 2260	2208	abde50003c72d01fb298231904a85950_NeikiAnalytics.exe	cmd.exe
PID 2208 wrote to memory of 2260	2208	abde50003c72d01fb298231904a85950_NeikiAnalytics.exe	cmd.exe
PID 2208 wrote to memory of 2260	2208	abde50003c72d01fb298231904a85950_NeikiAnalytics.exe	cmd.exe
PID 2260 wrote to memory of 2280	2260	cmd.exe	[email protected]
PID 2260 wrote to memory of 2280	2260	cmd.exe	[email protected]
PID 2260 wrote to memory of 2280	2260	cmd.exe	[email protected]
PID 2260 wrote to memory of 2280	2260	cmd.exe	[email protected]

C:\Users\Admin\AppData\Local\Temp\abde50003c72d01fb298231904a85950_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\abde50003c72d01fb298231904a85950_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208

C:\Users\Admin\AppData\Local\Temp\[email protected]
[email protected]
3⤵
- Executes dropped EXE
PID:2280

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
8814ceaf01949cddca4915d52a007cc8

SHA1
80775e2167027ff620a055a846eff80eb65a6fc7

SHA256
ccea018b24082c4730246e0b4a719a886d33b0872769805b20d53229f813ffc2

SHA512
ba0cc9259061cc872842c88be389e072adacb2f4f42aff3167a991abfaceb2b68c086e56266f81e71c9977366c2572643f534557ac38302c7f8718a3c55bdf08

Download Submit
memory/2208-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2280-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download