171f7e3b9fa3c7d7888dfc75fd134f90ea29cdffe490d5d5ce3390fedd59112d

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 03:52

Target

3131ea8af8a9ebc84358b210f6daf3e0_NeikiAnalytics.exe
Size

73KB
MD5

3131ea8af8a9ebc84358b210f6daf3e0
SHA1

b18b9c526dfaf631368408c8764e6d0b1025bdaa
SHA256

171f7e3b9fa3c7d7888dfc75fd134f90ea29cdffe490d5d5ce3390fedd59112d
SHA512

8f9a83ef6355a3c0d7732331a51758896709ac407c93e0f5b2f34fa818c2c8d79ff2659d186d0ac488aa8ec9f94a77f109230e4e9e33d4374f14e073d73c9c0d
SSDEEP

1536:hb/jvQTwIEK5QPqfhVWbdsmA+RjPFLC+e5hl0ZGUGf2g:hbj40IENPqfcxA+HFshlOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2712	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
1300	cmd.exe
1300	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1300	2220	3131ea8af8a9ebc84358b210f6daf3e0_NeikiAnalytics.exe	29
PID 2220 wrote to memory of 1300	2220	3131ea8af8a9ebc84358b210f6daf3e0_NeikiAnalytics.exe	29
PID 2220 wrote to memory of 1300	2220	3131ea8af8a9ebc84358b210f6daf3e0_NeikiAnalytics.exe	29
PID 2220 wrote to memory of 1300	2220	3131ea8af8a9ebc84358b210f6daf3e0_NeikiAnalytics.exe	29
PID 1300 wrote to memory of 2712	1300	cmd.exe	30
PID 1300 wrote to memory of 2712	1300	cmd.exe	30
PID 1300 wrote to memory of 2712	1300	cmd.exe	30
PID 1300 wrote to memory of 2712	1300	cmd.exe	30
PID 2712 wrote to memory of 2180	2712	[email protected]	31
PID 2712 wrote to memory of 2180	2712	[email protected]	31
PID 2712 wrote to memory of 2180	2712	[email protected]	31
PID 2712 wrote to memory of 2180	2712	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\3131ea8af8a9ebc84358b210f6daf3e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3131ea8af8a9ebc84358b210f6daf3e0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 15225.exe
      4⤵
      PID:2180

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
036ce2f9454ecf1feafd356abcd8cd0a

SHA1
fa3fd0ecd87b0427392c8d83df61d5e2f3153c93

SHA256
60a70716d6a9a3dd69e44519050b9fbea10f530716a72fdc9fa6fbd54a71d80d

SHA512
e99478221603d4f58a76e3b7ff053e809eac8238f65124eb0f0289cc30ca0f8dea71876598ac718e37d5b1533c7d0b43dd00038a9f11233277b54cf927b4f687

Download Submit
memory/2220-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2712-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download