f325d19b6f6bac0b0fd54f3dd4d2663b41b9caeae0f5fb3c2774d064a40d661a

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 19:29

Target

f2dbf69167cb3954086bcb382141dc10_NeikiAnalytics.exe
Size

73KB
MD5

f2dbf69167cb3954086bcb382141dc10
SHA1

e6c24c2b84f208c4f900a788989d061948a0341b
SHA256

f325d19b6f6bac0b0fd54f3dd4d2663b41b9caeae0f5fb3c2774d064a40d661a
SHA512

bab8ef46ee9c7af8b679848e93cf0f72d301104ea3a771d5725f0afebf2217c34c581a2a94bd6fbc794f4d1639dfca28f0509089682d5b59a774605248fa53a4
SSDEEP

1536:hbIpRaSX0YMOK5QPqfhVWbdsmA+RjPFLC+e5hMT0ZGUGf2g:hUpUYMONPqfcxA+HFshMTOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2480	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2104	cmd.exe
2104	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2104	1908	f2dbf69167cb3954086bcb382141dc10_NeikiAnalytics.exe	29
PID 1908 wrote to memory of 2104	1908	f2dbf69167cb3954086bcb382141dc10_NeikiAnalytics.exe	29
PID 1908 wrote to memory of 2104	1908	f2dbf69167cb3954086bcb382141dc10_NeikiAnalytics.exe	29
PID 1908 wrote to memory of 2104	1908	f2dbf69167cb3954086bcb382141dc10_NeikiAnalytics.exe	29
PID 2104 wrote to memory of 2480	2104	cmd.exe	30
PID 2104 wrote to memory of 2480	2104	cmd.exe	30
PID 2104 wrote to memory of 2480	2104	cmd.exe	30
PID 2104 wrote to memory of 2480	2104	cmd.exe	30
PID 2480 wrote to memory of 2872	2480	[email protected]	31
PID 2480 wrote to memory of 2872	2480	[email protected]	31
PID 2480 wrote to memory of 2872	2480	[email protected]	31
PID 2480 wrote to memory of 2872	2480	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\f2dbf69167cb3954086bcb382141dc10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\f2dbf69167cb3954086bcb382141dc10_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2480
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2872

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
73921015e1db82e880287005ac767612

SHA1
077d6d06876bd36289a57833c5e9d6a57cbb2209

SHA256
4c1627c438a63f0e809abce881a4f9b28af581a8beb08926cbb7378aa5006ca4

SHA512
03d2e86d8c6e5a565952fd83521ba75691ac4a874716c5c619489d5a2415c3a4f4ddaefdb35759d82dd69c0018f167019401b44a63f6b810cfa0ee7fa72fcc73

Download Submit
memory/1908-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2480-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download