110071882a79458be70079cd78fcce8a629c503eac5cc1fe0f189478812ddab0

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 05:37

Target

3baae772b330f2c360a60d4abdb40f60_NeikiAnalytics.exe
Size

79KB
MD5

3baae772b330f2c360a60d4abdb40f60
SHA1

5470fa7bee085fc729278a4e796824b9d8f5813b
SHA256

110071882a79458be70079cd78fcce8a629c503eac5cc1fe0f189478812ddab0
SHA512

8f7a2cff23b56c8d7b4f86dd784ad100aaf6dd810b2393b500c29b77d2b17d3688f54494ad8e5d9978217a3dd7559f1d22e43c349ec639848534cc8261c36a96
SSDEEP

1536:zvghcJIZTWGOQA8AkqUhMb2nuy5wgIP0CSJ+5ycB8GMGlZ5G:zvghixGdqU7uy5w9WMycN5G

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

[email protected]

pid process

2140 [email protected]
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

2424 cmd.exe
2424 cmd.exe

pid	process
2140	[email protected]

pid	process
2424	cmd.exe
2424	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

3baae772b330f2c360a60d4abdb40f60_NeikiAnalytics.execmd.exe

description	pid	process	target process
PID 2412 wrote to memory of 2424	2412	3baae772b330f2c360a60d4abdb40f60_NeikiAnalytics.exe	cmd.exe
PID 2412 wrote to memory of 2424	2412	3baae772b330f2c360a60d4abdb40f60_NeikiAnalytics.exe	cmd.exe
PID 2412 wrote to memory of 2424	2412	3baae772b330f2c360a60d4abdb40f60_NeikiAnalytics.exe	cmd.exe
PID 2412 wrote to memory of 2424	2412	3baae772b330f2c360a60d4abdb40f60_NeikiAnalytics.exe	cmd.exe
PID 2424 wrote to memory of 2140	2424	cmd.exe	[email protected]
PID 2424 wrote to memory of 2140	2424	cmd.exe	[email protected]
PID 2424 wrote to memory of 2140	2424	cmd.exe	[email protected]
PID 2424 wrote to memory of 2140	2424	cmd.exe	[email protected]

C:\Users\Admin\AppData\Local\Temp\3baae772b330f2c360a60d4abdb40f60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3baae772b330f2c360a60d4abdb40f60_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2140

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
8d9b02047024913895a1a2ae991a46ed

SHA1
a4231fef9cbdbe53fbddd439e96ef21c80ea423b

SHA256
a9b5ab72d9d12f039460c2a478e2266514810e77e15c02748b20d9f39fb65052

SHA512
a92a26344c66eba821069df3e3b5f94b3d27e7e07931a681b37a7a4afb4dd4718c50baf2bafeddffd0afa2cb0bb683be24a28c9711f60fd246b95f0265309c2c

Download Submit
memory/2140-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2412-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download