dad83ef030e6ae5b1cf8a954e91e136cd520f5dfb929752a19427530862b7387

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 23:30

Target

8ee869bd90a24cf1b18f1a0241dfdb80_NeikiAnalytics.exe
Size

73KB
MD5

8ee869bd90a24cf1b18f1a0241dfdb80
SHA1

2d35e66d78a6d687223636a7479914a19f2b4721
SHA256

dad83ef030e6ae5b1cf8a954e91e136cd520f5dfb929752a19427530862b7387
SHA512

bb48c8d32c4016f53a7edfc01920410662f17263b39a61138f491985188c91b3c956ff36c463aadd60619366e497f9c9b3a2ee55a2b6a1cc12fe39467b126f11
SSDEEP

1536:hbLRHTJCwUiK5QPqfhVWbdsmA+RjPFLC+e5hN0ZGUGf2g:hPVEw3NPqfcxA+HFshNOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2540	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2304	cmd.exe
2304	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2304	2928	8ee869bd90a24cf1b18f1a0241dfdb80_NeikiAnalytics.exe	29
PID 2928 wrote to memory of 2304	2928	8ee869bd90a24cf1b18f1a0241dfdb80_NeikiAnalytics.exe	29
PID 2928 wrote to memory of 2304	2928	8ee869bd90a24cf1b18f1a0241dfdb80_NeikiAnalytics.exe	29
PID 2928 wrote to memory of 2304	2928	8ee869bd90a24cf1b18f1a0241dfdb80_NeikiAnalytics.exe	29
PID 2304 wrote to memory of 2540	2304	cmd.exe	30
PID 2304 wrote to memory of 2540	2304	cmd.exe	30
PID 2304 wrote to memory of 2540	2304	cmd.exe	30
PID 2304 wrote to memory of 2540	2304	cmd.exe	30
PID 2540 wrote to memory of 2964	2540	[email protected]	31
PID 2540 wrote to memory of 2964	2540	[email protected]	31
PID 2540 wrote to memory of 2964	2540	[email protected]	31
PID 2540 wrote to memory of 2964	2540	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\8ee869bd90a24cf1b18f1a0241dfdb80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8ee869bd90a24cf1b18f1a0241dfdb80_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2964

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
64daa14492775ccbb7cfa7f648fa2bf0

SHA1
85e64335b4cfdf494cc3a010b5681ace7dd81d4b

SHA256
9c6acde646064ade78cc5724e8f883c43421267cabf1db9c5f43ebe9d103d169

SHA512
4058baf1bfe1b3a7ddd7c3b8b098b4c4edeeea7046af26734b68eb5b2e3b518520fcaec3b3ae49eca2ae0705eebdee496e47c558da422fa6f9bca5ddb6fd3515

Download Submit
memory/2540-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2928-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download