b9c43bb796506e3f15d2bde8f83ac525af7f27b89b5ad8235af6dfe2693f8323

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 23:56

Target

1b14cc72799d12f3eadd773862978530_NeikiAnalytics.exe
Size

79KB
MD5

1b14cc72799d12f3eadd773862978530
SHA1

f87e52521cc1a8ca3bffe406e411dfe68d380ed8
SHA256

b9c43bb796506e3f15d2bde8f83ac525af7f27b89b5ad8235af6dfe2693f8323
SHA512

9ead1dc896c7ed635b58075425faaa787de9d99f387901511a3b520647668d4ecab5e41631368775cf3aa6c4c870a0e576ad7fe18b11551beaadc8b71288bdc2
SSDEEP

1536:zvDDZmDCzNkEaXOQA8AkqUhMb2nuy5wgIP0CSJ+5yLB8GMGlZ5G:zvu4NR7GdqU7uy5w9WMyLN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2924	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2424	cmd.exe
2424	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2424	2664	1b14cc72799d12f3eadd773862978530_NeikiAnalytics.exe	29
PID 2664 wrote to memory of 2424	2664	1b14cc72799d12f3eadd773862978530_NeikiAnalytics.exe	29
PID 2664 wrote to memory of 2424	2664	1b14cc72799d12f3eadd773862978530_NeikiAnalytics.exe	29
PID 2664 wrote to memory of 2424	2664	1b14cc72799d12f3eadd773862978530_NeikiAnalytics.exe	29
PID 2424 wrote to memory of 2924	2424	cmd.exe	30
PID 2424 wrote to memory of 2924	2424	cmd.exe	30
PID 2424 wrote to memory of 2924	2424	cmd.exe	30
PID 2424 wrote to memory of 2924	2424	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\1b14cc72799d12f3eadd773862978530_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1b14cc72799d12f3eadd773862978530_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2924

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
d7a702b9e5518585e412725001e44fdd

SHA1
1397d8617f71855f5b15dde5d7c231b9a6f1805d

SHA256
3c091c04d25a78276831a9ab7cd8a0084424b5c3c7d26ea02886fffaef9cef8f

SHA512
f4020316c8f2b915a6aab95abd8fbe7cf08df62a597af3b554979c5525b3dcc66a63760ead7c6a6d401b644c9cef4061549d6ab618f161d1af7aed9e78eb246a

Download Submit
memory/2664-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2924-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download