a35abd5237ef7afa0e91b0a16ccc9a15786271b600d7dfb5d6e0d8fc2a58367a

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 06:38

Target

7e641d14ce1010c764b817b51c1d3970_NeikiAnalytics.exe
Size

73KB
MD5

7e641d14ce1010c764b817b51c1d3970
SHA1

84f69b737e3e0800f9a11d8c99e8e2a9d382dc49
SHA256

a35abd5237ef7afa0e91b0a16ccc9a15786271b600d7dfb5d6e0d8fc2a58367a
SHA512

4086130100de47ad21dadb58568718176311642a2be9290418053e2e96fecf2892fe511e2b6424b04404646e213f77585e23eb6f4bbe97cdec273a53e19c86f8
SSDEEP

1536:hb/pRBv9CNAK5QPqfhVWbdsmA+RjPFLC+e5hP0ZGUGf2g:hVPlCSNPqfcxA+HFshPOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2768	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2384	cmd.exe
2384	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2384	2888	7e641d14ce1010c764b817b51c1d3970_NeikiAnalytics.exe	29
PID 2888 wrote to memory of 2384	2888	7e641d14ce1010c764b817b51c1d3970_NeikiAnalytics.exe	29
PID 2888 wrote to memory of 2384	2888	7e641d14ce1010c764b817b51c1d3970_NeikiAnalytics.exe	29
PID 2888 wrote to memory of 2384	2888	7e641d14ce1010c764b817b51c1d3970_NeikiAnalytics.exe	29
PID 2384 wrote to memory of 2768	2384	cmd.exe	30
PID 2384 wrote to memory of 2768	2384	cmd.exe	30
PID 2384 wrote to memory of 2768	2384	cmd.exe	30
PID 2384 wrote to memory of 2768	2384	cmd.exe	30
PID 2768 wrote to memory of 3016	2768	[email protected]	31
PID 2768 wrote to memory of 3016	2768	[email protected]	31
PID 2768 wrote to memory of 3016	2768	[email protected]	31
PID 2768 wrote to memory of 3016	2768	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\7e641d14ce1010c764b817b51c1d3970_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7e641d14ce1010c764b817b51c1d3970_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2768
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:3016

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
58bc2d106836c4e8cbd295c85c6423f2

SHA1
5b287c218cbcef6093122ce9a67e9eca0dd7bb44

SHA256
4842c29d51beffc09f4f65291072c6fe369bbe26f32ff2c159110ba3a4a93ccf

SHA512
8f43e01de3854e985448778b6ebb445b0907ab79e0b70b3c201601ddc4c12790513c716b543bfdb915527864d1b1c2e13b0d4413ec92b1132f04a3c3895c97df

Download Submit
memory/2768-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2888-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download