e89591f1413cc7dc72e6f7316a8788a2d53a153e1752b90f087921e38a497580

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 18:27

Target

078d1bc2d6c6fcb6e439a68a640169c0_NeikiAnalytics.exe
Size

73KB
MD5

078d1bc2d6c6fcb6e439a68a640169c0
SHA1

652c45f54a9d71dfa832c0aae07f5282dfd43a5f
SHA256

e89591f1413cc7dc72e6f7316a8788a2d53a153e1752b90f087921e38a497580
SHA512

93d7fc75bbe492eb9fb5619320350eb7fba9958c7edf69f9194fb91bdbd46adfaf9e2dd0af583713ab9e2858e9320a16440aad13ab1df366a9c9fb9d11446527
SSDEEP

1536:hbu8Unt0jKK5QPqfhVWbdsmA+RjPFLC+e5hx0ZGUGf2g:hs0eNPqfcxA+HFshxOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2448	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2552	cmd.exe
2552	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2552	2440	078d1bc2d6c6fcb6e439a68a640169c0_NeikiAnalytics.exe	29
PID 2440 wrote to memory of 2552	2440	078d1bc2d6c6fcb6e439a68a640169c0_NeikiAnalytics.exe	29
PID 2440 wrote to memory of 2552	2440	078d1bc2d6c6fcb6e439a68a640169c0_NeikiAnalytics.exe	29
PID 2440 wrote to memory of 2552	2440	078d1bc2d6c6fcb6e439a68a640169c0_NeikiAnalytics.exe	29
PID 2552 wrote to memory of 2448	2552	cmd.exe	30
PID 2552 wrote to memory of 2448	2552	cmd.exe	30
PID 2552 wrote to memory of 2448	2552	cmd.exe	30
PID 2552 wrote to memory of 2448	2552	cmd.exe	30
PID 2448 wrote to memory of 2460	2448	[email protected]	31
PID 2448 wrote to memory of 2460	2448	[email protected]	31
PID 2448 wrote to memory of 2460	2448	[email protected]	31
PID 2448 wrote to memory of 2460	2448	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\078d1bc2d6c6fcb6e439a68a640169c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\078d1bc2d6c6fcb6e439a68a640169c0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2460

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
5c24b52678463a06cb4b9c2a1522fc63

SHA1
ff4988559a8efc2204e059055a0cb26106c47531

SHA256
7339bd7177b14846d9cccf2b2267a9d3fcdbcc717a22964fb48d25f5f26317b8

SHA512
e328e487f48eee65bc07b7196f21236362c4edfed952196d8db92644c0a3790506e139888a7a2f5afa1a6702d883020fb5d3fc440b5ed01a10716cea764b0ca5

Download Submit
memory/2440-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2448-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download