209d16a2fa446d0ff2bda16e29ffdfe26a0b15eef3d11ceb98f0f10bf306f946

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 14:44

Target

0a43a5c92b5fa18c42dbf2cab51d54a0_NeikiAnalytics.exe
Size

73KB
MD5

0a43a5c92b5fa18c42dbf2cab51d54a0
SHA1

b6f6eca622b7b9b5e51cd3d9fcbd5b7535f40027
SHA256

209d16a2fa446d0ff2bda16e29ffdfe26a0b15eef3d11ceb98f0f10bf306f946
SHA512

a8310b6153eabc28f5894891121a6d18b4693d001779503291d798c336b972870e46e1ae5ae40430688b9401db89db3787f7dc8a59d70a1c3b782e525a05c2e3
SSDEEP

1536:hb3jkiqsPeqK5QPqfhVWbdsmA+RjPFLC+e5hS0ZGUGf2g:hPkixPeqNPqfcxA+HFshSOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2256	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2272	cmd.exe
2272	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 2272	1804	0a43a5c92b5fa18c42dbf2cab51d54a0_NeikiAnalytics.exe	29
PID 1804 wrote to memory of 2272	1804	0a43a5c92b5fa18c42dbf2cab51d54a0_NeikiAnalytics.exe	29
PID 1804 wrote to memory of 2272	1804	0a43a5c92b5fa18c42dbf2cab51d54a0_NeikiAnalytics.exe	29
PID 1804 wrote to memory of 2272	1804	0a43a5c92b5fa18c42dbf2cab51d54a0_NeikiAnalytics.exe	29
PID 2272 wrote to memory of 2256	2272	cmd.exe	30
PID 2272 wrote to memory of 2256	2272	cmd.exe	30
PID 2272 wrote to memory of 2256	2272	cmd.exe	30
PID 2272 wrote to memory of 2256	2272	cmd.exe	30
PID 2256 wrote to memory of 3048	2256	[email protected]	31
PID 2256 wrote to memory of 3048	2256	[email protected]	31
PID 2256 wrote to memory of 3048	2256	[email protected]	31
PID 2256 wrote to memory of 3048	2256	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\0a43a5c92b5fa18c42dbf2cab51d54a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0a43a5c92b5fa18c42dbf2cab51d54a0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2256
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 15225.exe
      4⤵
      PID:3048

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
4c1bff623b6ca96445d497df6cf88e8d

SHA1
9dc0bf0b3e3c39d35698db804c0f5b3d7e5d2430

SHA256
adb55146396d25becc8d385bc7b54f08850024ceac8c23db906163bca6a0ea56

SHA512
a79b6c9759b115d3001a3284eff20668699a19fce1b609c0bc5c2a8d88c6406480e1e236ceba53dfb43530f7e6a1b71c1c7035242f8a8a87fb270d7180354141

Download Submit
memory/1804-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2256-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download