87eb8dcdf71e4b4c967f00d8e66ac701c29692a6fb92d7a9e4ab8892332d1caf

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 23:42

Target

997b4cdad36261306bbc339eb6f23520_NeikiAnalytics.exe
Size

79KB
MD5

997b4cdad36261306bbc339eb6f23520
SHA1

0b3686cf8a71d8f4616ac2edf9370207c8fa2128
SHA256

87eb8dcdf71e4b4c967f00d8e66ac701c29692a6fb92d7a9e4ab8892332d1caf
SHA512

bcc99178353faeeab08faee02f99d3a6aeacbe0ebd1cba920767cf2bc29d32d2a8bfc3237dd7316b157abec916bac93ad736cb2e9ba12378c8ad151128a467b9
SSDEEP

1536:zv48k0XV5rwOQA8AkqUhMb2nuy5wgIP0CSJ+5yHB8GMGlZ5G:zvS0XV7GdqU7uy5w9WMyHN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1744	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
1992	cmd.exe
1992	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1992	1756	997b4cdad36261306bbc339eb6f23520_NeikiAnalytics.exe	29
PID 1756 wrote to memory of 1992	1756	997b4cdad36261306bbc339eb6f23520_NeikiAnalytics.exe	29
PID 1756 wrote to memory of 1992	1756	997b4cdad36261306bbc339eb6f23520_NeikiAnalytics.exe	29
PID 1756 wrote to memory of 1992	1756	997b4cdad36261306bbc339eb6f23520_NeikiAnalytics.exe	29
PID 1992 wrote to memory of 1744	1992	cmd.exe	30
PID 1992 wrote to memory of 1744	1992	cmd.exe	30
PID 1992 wrote to memory of 1744	1992	cmd.exe	30
PID 1992 wrote to memory of 1744	1992	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\997b4cdad36261306bbc339eb6f23520_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\997b4cdad36261306bbc339eb6f23520_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:1744

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
24213a7b8c77ccd04caa591547792b01

SHA1
07cac6b6748decf1feeb6194a9d23df64f144676

SHA256
0807fe9fe33e47ba68ccac58bc3ddd28203fd1fac419afd6ce1dc956545805d9

SHA512
5cdea2254d0e40d6d1758d41aad60aa052080125fd2efb050837cabb545e2f6281bb97bfdcbd11761be6c28cd90c4289a1a152d33189559a5d2324ada4f3be43

Download Submit
memory/1744-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1756-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download