9a6913d04214c43bca3dd670c0e4b53c9247887d505e1d857911cac5491f7f52

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 02:44

Target

8d24a6e1a0917e3b4b772f1d4346b6e0_NeikiAnalytics.exe
Size

79KB
MD5

8d24a6e1a0917e3b4b772f1d4346b6e0
SHA1

64b8b061cc7764bc0e409fc147b4604dc87ca8b2
SHA256

9a6913d04214c43bca3dd670c0e4b53c9247887d505e1d857911cac5491f7f52
SHA512

62cf1649c6e642ef34dd856b26047719af053600cf1bf866062626963256ab64887087f7a8fb34ff546c3d65ad47b4ab1e0fb65b50e0f4f432f7fd3381eb8230
SSDEEP

1536:zvm5Om0rld8Ms1FAOgSmOQA8AkqUhMb2nuy5wgIP0CSJ+5yYB8GMGlZ5G:zvm5OTld8r1QSjGdqU7uy5w9WMyYN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2920	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
1920	cmd.exe
1920	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 1920	2868	8d24a6e1a0917e3b4b772f1d4346b6e0_NeikiAnalytics.exe	29
PID 2868 wrote to memory of 1920	2868	8d24a6e1a0917e3b4b772f1d4346b6e0_NeikiAnalytics.exe	29
PID 2868 wrote to memory of 1920	2868	8d24a6e1a0917e3b4b772f1d4346b6e0_NeikiAnalytics.exe	29
PID 2868 wrote to memory of 1920	2868	8d24a6e1a0917e3b4b772f1d4346b6e0_NeikiAnalytics.exe	29
PID 1920 wrote to memory of 2920	1920	cmd.exe	30
PID 1920 wrote to memory of 2920	1920	cmd.exe	30
PID 1920 wrote to memory of 2920	1920	cmd.exe	30
PID 1920 wrote to memory of 2920	1920	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\8d24a6e1a0917e3b4b772f1d4346b6e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8d24a6e1a0917e3b4b772f1d4346b6e0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2920

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
d2624205f27111d627d6a7ed0f715995

SHA1
dda26c934f055d28affcdec346c8e01f70b23eeb

SHA256
f3a89757b7fb2099cf970ef9a2f85017a28cf144ceabb92b5d9a487907bdaa5c

SHA512
43aa4d86b1cbc941df6765f2b175a76d17449adcae13543d30545c6d6415618e1254c69c37d054085f7383f30ae8f726ce6ea14ad1d2707abfdec38a0183a0e4

Download Submit
memory/2868-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2920-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download