e3b1c216acc4b3a208cb81e43f4e9bef7892e1eadf25b379ed2aa6f0d7b2b48d

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 23:50

Target

27b278a9e12940565af0c10eee55b670_NeikiAnalytics.exe
Size

79KB
MD5

27b278a9e12940565af0c10eee55b670
SHA1

646e50b4232b498a2d0e565e1cc20d60881aa16d
SHA256

e3b1c216acc4b3a208cb81e43f4e9bef7892e1eadf25b379ed2aa6f0d7b2b48d
SHA512

455d95496bbf375edc1811f186a31da2488fb19ed64b183b5d8d29f6e3c34daac5b1b69f9c6389fc4b6309194f1c58b882bdc585dbe46afc640b352ddda84917
SSDEEP

1536:zvAhxj6A58e8lOQA8AkqUhMb2nuy5wgIP0CSJ+5yBB8GMGlZ5G:zvAX6A58eBGdqU7uy5w9WMyBN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1936	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
1740	cmd.exe
1740	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 1740	1796	27b278a9e12940565af0c10eee55b670_NeikiAnalytics.exe	29
PID 1796 wrote to memory of 1740	1796	27b278a9e12940565af0c10eee55b670_NeikiAnalytics.exe	29
PID 1796 wrote to memory of 1740	1796	27b278a9e12940565af0c10eee55b670_NeikiAnalytics.exe	29
PID 1796 wrote to memory of 1740	1796	27b278a9e12940565af0c10eee55b670_NeikiAnalytics.exe	29
PID 1740 wrote to memory of 1936	1740	cmd.exe	30
PID 1740 wrote to memory of 1936	1740	cmd.exe	30
PID 1740 wrote to memory of 1936	1740	cmd.exe	30
PID 1740 wrote to memory of 1936	1740	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\27b278a9e12940565af0c10eee55b670_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\27b278a9e12940565af0c10eee55b670_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:1936

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
87a4c742dd1818f3b63ddd0e148d6157

SHA1
63309283c6eee7c6129fb7398112c641932aab30

SHA256
b94591a3df1cf644255a68ac39925cf5e6da051cdf931e94352ce02a58dabd2b

SHA512
51b0fa7ff2b896f7eef7fc32027b40e2f83030b1c2e28f94201da38b0550f6c3edf994c4fb6e775fe3046c61d1ee14eb312d96a36ae978b9ebdc91ac6bf213c1

Download Submit
memory/1796-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1936-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download