959cbbc86acb29636f637ba417c9bc7187dc420ec1abb168bb569e1ecb3f075f

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 08:54

Target

e2fd60427a5ea5c84187c5163b025b40_NeikiAnalytics.exe
Size

79KB
MD5

e2fd60427a5ea5c84187c5163b025b40
SHA1

ff39f24294bc4e8caf286d493184105a668016b9
SHA256

959cbbc86acb29636f637ba417c9bc7187dc420ec1abb168bb569e1ecb3f075f
SHA512

3dc84f9f9b83d7e2d32a1a17319a93c4a6944dc6601a82ca0a4e76bae9096ba5c147ced76d83be3933376f8850c97e9ea2d0c808aaf25f4c1c3216daf88c8551
SSDEEP

1536:zvKoxeJSer4voclnVU+GNOQA8AkqUhMb2nuy5wgIP0CSJ+5yhB8GMGlZ5G:zvBMnr4hlnViUGdqU7uy5w9WMyhN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3036	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
3016	cmd.exe
3016	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 3016	2876	e2fd60427a5ea5c84187c5163b025b40_NeikiAnalytics.exe	29
PID 2876 wrote to memory of 3016	2876	e2fd60427a5ea5c84187c5163b025b40_NeikiAnalytics.exe	29
PID 2876 wrote to memory of 3016	2876	e2fd60427a5ea5c84187c5163b025b40_NeikiAnalytics.exe	29
PID 2876 wrote to memory of 3016	2876	e2fd60427a5ea5c84187c5163b025b40_NeikiAnalytics.exe	29
PID 3016 wrote to memory of 3036	3016	cmd.exe	30
PID 3016 wrote to memory of 3036	3016	cmd.exe	30
PID 3016 wrote to memory of 3036	3016	cmd.exe	30
PID 3016 wrote to memory of 3036	3016	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\e2fd60427a5ea5c84187c5163b025b40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e2fd60427a5ea5c84187c5163b025b40_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:3036

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
68b41b704f2ea219ab2ae1647e97aec5

SHA1
d003aeddecbda25147ea77a2788d253f4e4a525e

SHA256
bf5b9e63cff976a20d03f953be3abf08b4a119d10ccd792c24ee9bca9f53641f

SHA512
83dde42a34c05d262115f3b0f7c1dc7b9f02d1a2e7168bf56f7877e72038f84b79ce736eb5ba5839670702d61af4ca5513d455e8f216a20c0d6787eebf96dc8a

Download Submit
memory/2876-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3036-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download