38de997040089854b0adf269067a6c1872d033c30d7709955739f8852cdaafc4

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 01:18

Target

2b1fee297f1e0a9cbb2cd663a1aa9b20_NeikiAnalytics.exe
Size

73KB
MD5

2b1fee297f1e0a9cbb2cd663a1aa9b20
SHA1

794fe5cf2bde75d25fa6a5a3c32c8c4b53af7e84
SHA256

38de997040089854b0adf269067a6c1872d033c30d7709955739f8852cdaafc4
SHA512

7778dd1118aa465e9b70e98f485198ed1d122a9254be8aa50399bb78e2dbbe1dee3cf5f048476c6552673d8c3bd78947963068fb562ff830bfdafe87420c4948
SSDEEP

1536:hbR9z8EVrXYK5QPqfhVWbdsmA+RjPFLC+e5h20ZGUGf2g:hj/YNPqfcxA+HFsh2Og

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2940	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2468	cmd.exe
2468	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2468	2612	2b1fee297f1e0a9cbb2cd663a1aa9b20_NeikiAnalytics.exe	29
PID 2612 wrote to memory of 2468	2612	2b1fee297f1e0a9cbb2cd663a1aa9b20_NeikiAnalytics.exe	29
PID 2612 wrote to memory of 2468	2612	2b1fee297f1e0a9cbb2cd663a1aa9b20_NeikiAnalytics.exe	29
PID 2612 wrote to memory of 2468	2612	2b1fee297f1e0a9cbb2cd663a1aa9b20_NeikiAnalytics.exe	29
PID 2468 wrote to memory of 2940	2468	cmd.exe	30
PID 2468 wrote to memory of 2940	2468	cmd.exe	30
PID 2468 wrote to memory of 2940	2468	cmd.exe	30
PID 2468 wrote to memory of 2940	2468	cmd.exe	30
PID 2940 wrote to memory of 2480	2940	[email protected]	31
PID 2940 wrote to memory of 2480	2940	[email protected]	31
PID 2940 wrote to memory of 2480	2940	[email protected]	31
PID 2940 wrote to memory of 2480	2940	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\2b1fee297f1e0a9cbb2cd663a1aa9b20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2b1fee297f1e0a9cbb2cd663a1aa9b20_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2940
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 321024.exe
      4⤵
      PID:2480

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
9cd1066ef3278461bf700a6fcd7f62a6

SHA1
93e4447c9e68f093933a31e3ad33f2ec6026c52d

SHA256
1d69abd442d2fd94febac12f03706337678bb8b66c3e4d996f6859d57243f877

SHA512
93ea3b48286dd5611eea2ebc63cfeb97fc7f0cf56e41ca618ef0f9604737d3f66fd79c61844ab743f584d3a9b0f11ea9a11f81e0c583b06eb03d7c7d8c4a4d2e

Download Submit
memory/2612-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2940-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download