f872fc4c10cd94c6e0febc841ee512e10b22c54401c0762ff73c1bfd7cc5d4ef

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 11:33

Target

4b374d0aab52c54cafdf8e729dd2bf30_NeikiAnalytics.exe
Size

73KB
MD5

4b374d0aab52c54cafdf8e729dd2bf30
SHA1

86d8f3a659fdb4fe2b31788f4e9628054ee0ef45
SHA256

f872fc4c10cd94c6e0febc841ee512e10b22c54401c0762ff73c1bfd7cc5d4ef
SHA512

22cfe139730a49410263d8c7c5d25864390d08838d14174a5c4f7a6788355e6d409a6a10ed0e947d8ca1fc6b6d8664d39de362b00325c97817c5c439e08919fc
SSDEEP

1536:hbe8ccvU59K5QPqfhVWbdsmA+RjPFLC+e5hYz0ZGUGf2g:haYv+NPqfcxA+HFshiOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2776	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2912	cmd.exe
2912	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2912	2056	4b374d0aab52c54cafdf8e729dd2bf30_NeikiAnalytics.exe	29
PID 2056 wrote to memory of 2912	2056	4b374d0aab52c54cafdf8e729dd2bf30_NeikiAnalytics.exe	29
PID 2056 wrote to memory of 2912	2056	4b374d0aab52c54cafdf8e729dd2bf30_NeikiAnalytics.exe	29
PID 2056 wrote to memory of 2912	2056	4b374d0aab52c54cafdf8e729dd2bf30_NeikiAnalytics.exe	29
PID 2912 wrote to memory of 2776	2912	cmd.exe	30
PID 2912 wrote to memory of 2776	2912	cmd.exe	30
PID 2912 wrote to memory of 2776	2912	cmd.exe	30
PID 2912 wrote to memory of 2776	2912	cmd.exe	30
PID 2776 wrote to memory of 2556	2776	[email protected]	31
PID 2776 wrote to memory of 2556	2776	[email protected]	31
PID 2776 wrote to memory of 2556	2776	[email protected]	31
PID 2776 wrote to memory of 2556	2776	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\4b374d0aab52c54cafdf8e729dd2bf30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4b374d0aab52c54cafdf8e729dd2bf30_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2556

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
db18f6729ca20f7c19b4ecc489d5003a

SHA1
0f5cc9f65f0c322deca9ea6b31f7d0b76db1668d

SHA256
6ed4316d047c0a05ad342f5997b95b9a30d9da0be727b996d2568b644fa91f56

SHA512
82aa25e9ad814d26ffb145111183d14b77a277bd93ac49edab44da4f88af47647318412aa03626e764726138cf3a1ea1e0f47b1101cd306908a4030d3b2279f8

Download Submit
memory/2056-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2776-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download