bead02c3526ddebff859d1a945d7d147a8d38514f1d11cd95c8e3e58cdabfdef

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 22:00

Target

266fcb736df848a6d4fe8aba9c2fc690_NeikiAnalytics.exe
Size

79KB
MD5

266fcb736df848a6d4fe8aba9c2fc690
SHA1

d6715f489ca84a1d3bbb05b39a548220b4f12525
SHA256

bead02c3526ddebff859d1a945d7d147a8d38514f1d11cd95c8e3e58cdabfdef
SHA512

013e00217959c87b35bf4a19870a923b1cdc3c31bfb21f1e2507e2b10683696b70c9165a8e63376b81c4e194192f3b4acab1985216ff6079118adb8b58b7faa2
SSDEEP

1536:zvDkSFQbBgkHBsSpOQA8AkqUhMb2nuy5wgIP0CSJ+5ymCmB8GMGlZ5G:zvDk8IBTSlGdqU7uy5w9WMymFN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2416	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
1976	cmd.exe
1976	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 108 wrote to memory of 1976	108	266fcb736df848a6d4fe8aba9c2fc690_NeikiAnalytics.exe	29
PID 108 wrote to memory of 1976	108	266fcb736df848a6d4fe8aba9c2fc690_NeikiAnalytics.exe	29
PID 108 wrote to memory of 1976	108	266fcb736df848a6d4fe8aba9c2fc690_NeikiAnalytics.exe	29
PID 108 wrote to memory of 1976	108	266fcb736df848a6d4fe8aba9c2fc690_NeikiAnalytics.exe	29
PID 1976 wrote to memory of 2416	1976	cmd.exe	30
PID 1976 wrote to memory of 2416	1976	cmd.exe	30
PID 1976 wrote to memory of 2416	1976	cmd.exe	30
PID 1976 wrote to memory of 2416	1976	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\266fcb736df848a6d4fe8aba9c2fc690_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\266fcb736df848a6d4fe8aba9c2fc690_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2416

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
c3e4c2257f3e9543abb08d870a98a5a9

SHA1
c1250c3817317e554cae8b5a13a7187897525da2

SHA256
97bf0d6340e21fb58df0781c84985baffac7c7653e889a34a115ad91a211da88

SHA512
8b2539c7611ceb4aa98b87ca8c2115fb6a5ea6ef44b35f1b752191fe2495c03584811fddab979a22a12a1b533af6428eed3ce6b902c95c66f03f073bf4039b2b

Download Submit
memory/108-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2416-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download