a8e63d9c7707d8a52810d30a5d6f88649a514b150574519232738015e86ca16d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 03:20

Target

5a88a91d148f08635cfb97c1e92c4410_NeikiAnalytics.exe
Size

9.5MB
MD5

5a88a91d148f08635cfb97c1e92c4410
SHA1

5b307e375b83ce776ca80945828a8ccb5fba8610
SHA256

a8e63d9c7707d8a52810d30a5d6f88649a514b150574519232738015e86ca16d
SHA512

b8a24f3c4e54f4887041f18c7d0712011b3150ae464100c30168def48dfb41894c71ade945cde52a5613ed1e797724b89a1dbe6431e7bb5a1e39f9402558e7b2
SSDEEP

196608:ItH/1F1Hmw5bHyIT2xha1AreNrYFJMIDJ+gsAGKpR5QQgRAdQygWLFO:MH/FF575ua1n8Fqy+gsi5Aprs

Score

7^/10

upx

Loads dropped DLL 1 IoCs

Processes:

5a88a91d148f08635cfb97c1e92c4410_NeikiAnalytics.exe

pid process

2480 5a88a91d148f08635cfb97c1e92c4410_NeikiAnalytics.exe

pid	process
2480	5a88a91d148f08635cfb97c1e92c4410_NeikiAnalytics.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI28482\python310.dll	upx
behavioral1/memory/2480-48-0x000007FEF5A10000-0x000007FEF5E7E000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

5a88a91d148f08635cfb97c1e92c4410_NeikiAnalytics.exe

description	pid	process	target process
PID 2848 wrote to memory of 2480	2848	5a88a91d148f08635cfb97c1e92c4410_NeikiAnalytics.exe	5a88a91d148f08635cfb97c1e92c4410_NeikiAnalytics.exe
PID 2848 wrote to memory of 2480	2848	5a88a91d148f08635cfb97c1e92c4410_NeikiAnalytics.exe	5a88a91d148f08635cfb97c1e92c4410_NeikiAnalytics.exe
PID 2848 wrote to memory of 2480	2848	5a88a91d148f08635cfb97c1e92c4410_NeikiAnalytics.exe	5a88a91d148f08635cfb97c1e92c4410_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\5a88a91d148f08635cfb97c1e92c4410_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5a88a91d148f08635cfb97c1e92c4410_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Users\Admin\AppData\Local\Temp\5a88a91d148f08635cfb97c1e92c4410_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\5a88a91d148f08635cfb97c1e92c4410_NeikiAnalytics.exe"
  2⤵
  - Loads dropped DLL
  PID:2480

C:\Users\Admin\AppData\Local\Temp\_MEI28482\python310.dll

Filesize
1.4MB

MD5
196deb9a74e6e9e242f04008ea80f7d3

SHA1
a54373ebad306f3e6f585bcdf1544fbdcf9c0386

SHA256
20b004bfe69166c4961fee93163e795746df39fb31dc67399c0fde57f551eb75

SHA512
8c226d3ef21f3ddeee14a098c60ef030fa78590e9505d015ce63ea5e5bbcea2e105ff818e94653df1bddc9ba6ed3b376a1dff5c19266b623fa22cd75ac263b68

Download Submit
memory/2480-48-0x000007FEF5A10000-0x000007FEF5E7E000-memory.dmp

Filesize
4.4MB

Download