d2433f2a72dcbe2909fb13cb73bf38fa4d81c11eac94bfc0670f35df6aca8532

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 21:24

Target

e2d714b6bd1fb522e8417bfe0d079d10_NeikiAnalytics.exe
Size

73KB
MD5

e2d714b6bd1fb522e8417bfe0d079d10
SHA1

93eb1f7749bb8fb5872f640a8e83aebcc7a4d694
SHA256

d2433f2a72dcbe2909fb13cb73bf38fa4d81c11eac94bfc0670f35df6aca8532
SHA512

3306ee7abfaa98aef88d91bfc5df08d31229ae11577974bb292f2ed065cfcf612816e4e9eefeddf37a391059a96d4bb5831719429497833ba5aeaf281c69e55e
SSDEEP

1536:hbpaTkaJRXOTK5QPqfhVWbdsmA+RjPFLC+e5h30ZGUGf2g:h0rRX+NPqfcxA+HFsh3Og

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2472	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2664	cmd.exe
2664	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2664	2460	e2d714b6bd1fb522e8417bfe0d079d10_NeikiAnalytics.exe	29
PID 2460 wrote to memory of 2664	2460	e2d714b6bd1fb522e8417bfe0d079d10_NeikiAnalytics.exe	29
PID 2460 wrote to memory of 2664	2460	e2d714b6bd1fb522e8417bfe0d079d10_NeikiAnalytics.exe	29
PID 2460 wrote to memory of 2664	2460	e2d714b6bd1fb522e8417bfe0d079d10_NeikiAnalytics.exe	29
PID 2664 wrote to memory of 2472	2664	cmd.exe	30
PID 2664 wrote to memory of 2472	2664	cmd.exe	30
PID 2664 wrote to memory of 2472	2664	cmd.exe	30
PID 2664 wrote to memory of 2472	2664	cmd.exe	30
PID 2472 wrote to memory of 2524	2472	[email protected]	31
PID 2472 wrote to memory of 2524	2472	[email protected]	31
PID 2472 wrote to memory of 2524	2472	[email protected]	31
PID 2472 wrote to memory of 2524	2472	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\e2d714b6bd1fb522e8417bfe0d079d10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e2d714b6bd1fb522e8417bfe0d079d10_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2472
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2524

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
84d8c07f4245d0ac10758f7beff886fc

SHA1
4285edb9071bf9343f95c0e91b002105862f4003

SHA256
edaf3cebd3e8ed5d69e04f20a8ebd5784a710f5f9f7c3e9154b9369c5b94d058

SHA512
c2a3c7290481c3b4c04a074c1c709c312bd5d56c9791448c11f160a1180aa3989d14c52bcf3f4005bfe4250c09125abb2d1b0252bdd881d548b2277778b0667b

Download Submit
memory/2460-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2472-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download