376ce5e270d3ddb2094c498fa3b4aedb82dee5e5ce3e807983df3c7034c524da

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 11:44

Target
bb0e823be67b0ae474f3be8e1f583770_NeikiAnalytics.exe
Size 79KB
Sample240527-nwct7abb44
SHA256 376ce5e270d3ddb2094c498fa3b4aedb82dee5e5ce3e807983df3c7034c524da
MD5 bb0e823be67b0ae474f3be8e1f583770
SHA1 99b9fe9adf4e0089408a629d18f7f556fd547e32
SHA512 04addada335bab465ad6698b1fb5ba4b47e7558d19cbef7b990df5b4599108dbc141c9b12e5a05f5942e8d865ac700bb53d868f8e91941e3ae2aa81c1b14b349
SSDEEP 1536:zvec2PUdwS/2YOQA8AkqUhMb2nuy5wgIP0CSJ+5ydB8GMGlZ5G:zveXPUur9GdqU7uy5w9WMydN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2872	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2788	cmd.exe
2788	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2788	1724	bb0e823be67b0ae474f3be8e1f583770_NeikiAnalytics.exe	29
PID 1724 wrote to memory of 2788	1724	bb0e823be67b0ae474f3be8e1f583770_NeikiAnalytics.exe	29
PID 1724 wrote to memory of 2788	1724	bb0e823be67b0ae474f3be8e1f583770_NeikiAnalytics.exe	29
PID 1724 wrote to memory of 2788	1724	bb0e823be67b0ae474f3be8e1f583770_NeikiAnalytics.exe	29
PID 2788 wrote to memory of 2872	2788	cmd.exe	30
PID 2788 wrote to memory of 2872	2788	cmd.exe	30
PID 2788 wrote to memory of 2872	2788	cmd.exe	30
PID 2788 wrote to memory of 2872	2788	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\bb0e823be67b0ae474f3be8e1f583770_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\bb0e823be67b0ae474f3be8e1f583770_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2872

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 867fc2418320595d3353940573b47029f5709044dd40f5205c10f26baedb07ac
MD5 0425074b7808d3182ddec8a747b7d45a
SHA1 bbdf5b987a6c82c932c2f0d565a8df048926a6ba
SHA512 47c2f010a71c4e4679d21fcf8cdcd1dbdcb773894b142eb515f5e55b03b8100d2192bf5830679835d8bcc3a1f520630fba837ca5867ea69dc3facc14939ab777
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5yJB8GMGlZ5G:zv+vTpGdqU7uy5w9WMyJN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1724-8-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2872-7-0x0000000000400000-0x000000000041B000-memory.dmp

Download