1e9dfd5e4c79b07643b636220516c42764a8de6e33385f30af6015d9fe4957cd

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 21:47

Target

0b490c6d93846a43fc9d757794050bd0_NeikiAnalytics.exe
Size

79KB
MD5

0b490c6d93846a43fc9d757794050bd0
SHA1

065214fc120381e761ae5e73cbb8e909acc94756
SHA256

1e9dfd5e4c79b07643b636220516c42764a8de6e33385f30af6015d9fe4957cd
SHA512

68ff662c31deefa47e99c329480a6d22a7d9d1154c8ff22d88e68bbefa9df9c4ade7cac30353789b5352f53c920f4db8861b0df3166d2dad940dbb42763d2c6c
SSDEEP

1536:zvdpDHWjMdEtZeZv9OQA8AkqUhMb2nuy5wgIP0CSJ+5ySB8GMGlZ5G:zvdpCIcmvkGdqU7uy5w9WMySN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1936	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2284	cmd.exe
2284	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2284	1692	0b490c6d93846a43fc9d757794050bd0_NeikiAnalytics.exe	29
PID 1692 wrote to memory of 2284	1692	0b490c6d93846a43fc9d757794050bd0_NeikiAnalytics.exe	29
PID 1692 wrote to memory of 2284	1692	0b490c6d93846a43fc9d757794050bd0_NeikiAnalytics.exe	29
PID 1692 wrote to memory of 2284	1692	0b490c6d93846a43fc9d757794050bd0_NeikiAnalytics.exe	29
PID 2284 wrote to memory of 1936	2284	cmd.exe	30
PID 2284 wrote to memory of 1936	2284	cmd.exe	30
PID 2284 wrote to memory of 1936	2284	cmd.exe	30
PID 2284 wrote to memory of 1936	2284	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\0b490c6d93846a43fc9d757794050bd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0b490c6d93846a43fc9d757794050bd0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:1936

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
27b6b7a866cb1e1785fa460250897dcd

SHA1
f584a4bc13a6375551345adefdd9f916a308948d

SHA256
b7cdc721510a9083760cd30a1ae0e83454b4b303951708e5344ea7392969a4b6

SHA512
42a676ec98314432ed4ea9507a64a44347e7e7764cc48feb5a122dd57e6a6780823329229de1fd37eea138993271ba863df59ce5d23cc3d6e111e7e8a1da872e

Download Submit
memory/1692-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1936-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download