cfa4cc4d653b0328e8007fdb9ea2599b6f073bbf4fd047ec9b0e9a266f7ebb1c

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:09

Target

3c294fb80666b38484b4eecee9dc23c0_NeikiAnalytics.exe
Size

73KB
MD5

3c294fb80666b38484b4eecee9dc23c0
SHA1

f32079cc8c269181650dc3123cec9b75945b9eb0
SHA256

cfa4cc4d653b0328e8007fdb9ea2599b6f073bbf4fd047ec9b0e9a266f7ebb1c
SHA512

748e093c3d544e76bb11840892ebf05243e5d53ed7ce74c6ddbae391c3b1b5e17c00dad1087fcc48af7b831057d3bd6f806a2b5818d403797e0d5ca4f4ec7d26
SSDEEP

1536:hbRq1lLZM7X/PK5QPqfhVWbdsmA+RjPFLC+e5ha0ZGUGf2g:h1qPajNPqfcxA+HFshaOg

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

[email protected]

pid process

2032 [email protected]
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

2984 cmd.exe
2984 cmd.exe

pid	process
2032	[email protected]

pid	process
2984	cmd.exe
2984	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

3c294fb80666b38484b4eecee9dc23c0_NeikiAnalytics.execmd.exe[email protected]

description	pid	process	target process
PID 1704 wrote to memory of 2984	1704	3c294fb80666b38484b4eecee9dc23c0_NeikiAnalytics.exe	cmd.exe
PID 1704 wrote to memory of 2984	1704	3c294fb80666b38484b4eecee9dc23c0_NeikiAnalytics.exe	cmd.exe
PID 1704 wrote to memory of 2984	1704	3c294fb80666b38484b4eecee9dc23c0_NeikiAnalytics.exe	cmd.exe
PID 1704 wrote to memory of 2984	1704	3c294fb80666b38484b4eecee9dc23c0_NeikiAnalytics.exe	cmd.exe
PID 2984 wrote to memory of 2032	2984	cmd.exe	[email protected]
PID 2984 wrote to memory of 2032	2984	cmd.exe	[email protected]
PID 2984 wrote to memory of 2032	2984	cmd.exe	[email protected]
PID 2984 wrote to memory of 2032	2984	cmd.exe	[email protected]
PID 2032 wrote to memory of 2552	2032	[email protected]	cmd.exe
PID 2032 wrote to memory of 2552	2032	[email protected]	cmd.exe
PID 2032 wrote to memory of 2552	2032	[email protected]	cmd.exe
PID 2032 wrote to memory of 2552	2032	[email protected]	cmd.exe

C:\Users\Admin\AppData\Local\Temp\3c294fb80666b38484b4eecee9dc23c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3c294fb80666b38484b4eecee9dc23c0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 16256.exe
      4⤵
      PID:2552

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
95f6aec276ab5e81e4e6a340ad2e0764

SHA1
d4aac2c393fca86fc3830c8764769def2ba1f98b

SHA256
d25410ecbeb537bd324bc32e3c933be61465016921b62afd945b249cc5c262a7

SHA512
c5903f5d5765179d2a38fa64c4dfa716d311959e1c31ff6a74956bd70324902c67474db7878faa278401472b9d9c564b7f2199b6be883d39b4aac982de50ac64

Download Submit
memory/1704-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2032-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download