62476694c99eb5c6299945513501dcdbdc6dc03ec39527bc75c383da8845084f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 08:38

Target

2a22dde93006ad8828ffb1c671a43d00_NeikiAnalytics.exe
Size

79KB
MD5

2a22dde93006ad8828ffb1c671a43d00
SHA1

20fb7b8e85665cc33cc6a7a602ec0f21fda2b4e1
SHA256

62476694c99eb5c6299945513501dcdbdc6dc03ec39527bc75c383da8845084f
SHA512

a213395ecb142ce25aeb3ea0f638e562222a35b52383e9682c5c5810bc5c6a1fcdb183a78a9f080c8b9768cd8f8bf1b1f68c7bc93297c338ed285ab90949568a
SSDEEP

1536:zvhLVkSFqmJOQA8AkqUhMb2nuy5wgIP0CSJ+5yBB8GMGlZ5G:zvfkStIGdqU7uy5w9WMyBN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2864	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2860	cmd.exe
2860	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2860	2684	2a22dde93006ad8828ffb1c671a43d00_NeikiAnalytics.exe	29
PID 2684 wrote to memory of 2860	2684	2a22dde93006ad8828ffb1c671a43d00_NeikiAnalytics.exe	29
PID 2684 wrote to memory of 2860	2684	2a22dde93006ad8828ffb1c671a43d00_NeikiAnalytics.exe	29
PID 2684 wrote to memory of 2860	2684	2a22dde93006ad8828ffb1c671a43d00_NeikiAnalytics.exe	29
PID 2860 wrote to memory of 2864	2860	cmd.exe	30
PID 2860 wrote to memory of 2864	2860	cmd.exe	30
PID 2860 wrote to memory of 2864	2860	cmd.exe	30
PID 2860 wrote to memory of 2864	2860	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\2a22dde93006ad8828ffb1c671a43d00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2a22dde93006ad8828ffb1c671a43d00_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2864

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
52526c30f12b32718c0dd2e6d39ccc17

SHA1
c752e712114034ae2737743c5694ffcf6cb8d3b6

SHA256
9668e91dda7d4264345130b56c5a1a06123747c360ccffbbf3deb5636c7e1bb5

SHA512
76df5b6403d643c116d0038b77432ba5ce8f121d66a399e868463285e33b9bf5ba267b7fc3d44d4cfaed3794cf9ffc4cca62e944f6ea8993e39ddb4ec966baf6

Download Submit
memory/2684-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2864-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download