fca526cf40d4c8e982acf7ed6753d13f949674ab37e02aa405e596b86e610335

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 04:41

Target

46333e9a0fd3e14f4cb83399d0aa7090_NeikiAnalytics.exe
Size

79KB
MD5

46333e9a0fd3e14f4cb83399d0aa7090
SHA1

1a98ca0607312b246029dd0e69c6687c68bc354b
SHA256

fca526cf40d4c8e982acf7ed6753d13f949674ab37e02aa405e596b86e610335
SHA512

b33d4250bd99f4b87365c53514f20ae3514be2bb30eefafb93f14feae2dc7376d95125af7d08b6900a78d7b5c7f4a17b469ddc4e98b7e9114f21381944b247be
SSDEEP

1536:zvS9+LJ8lZuCUuTOQA8AkqUhMb2nuy5wgIP0CSJ+5ybB8GMGlZ5G:zvS9O8lZuCmGdqU7uy5w9WMybN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1068	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2668	cmd.exe
2668	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2668	1956	46333e9a0fd3e14f4cb83399d0aa7090_NeikiAnalytics.exe	29
PID 1956 wrote to memory of 2668	1956	46333e9a0fd3e14f4cb83399d0aa7090_NeikiAnalytics.exe	29
PID 1956 wrote to memory of 2668	1956	46333e9a0fd3e14f4cb83399d0aa7090_NeikiAnalytics.exe	29
PID 1956 wrote to memory of 2668	1956	46333e9a0fd3e14f4cb83399d0aa7090_NeikiAnalytics.exe	29
PID 2668 wrote to memory of 1068	2668	cmd.exe	30
PID 2668 wrote to memory of 1068	2668	cmd.exe	30
PID 2668 wrote to memory of 1068	2668	cmd.exe	30
PID 2668 wrote to memory of 1068	2668	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\46333e9a0fd3e14f4cb83399d0aa7090_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\46333e9a0fd3e14f4cb83399d0aa7090_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:1068

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
1b922db43f88e014d432f4ab952de1fe

SHA1
7790345c4e1834e916e0b767b0ae7ff9ceed7de1

SHA256
01762b89c8bc980aa542da288ff9ed9ef195192751476720c56e8c381e02de23

SHA512
1103adf7e2f3aae8ab2d79ab4084c0927192d29b4afc36d703184595c467bfbef02baa5fdb4e9bbd69a1e690332144e186bf7f7fdd8f2d87b8e08727a420ed19

Download Submit
memory/1068-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1956-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download