af80572a06f545033a93cb4a85f8113fcf5842da61e416db4373f1ac2dedd95d

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 07:21

Target

388b4ddf4aa8a8077b820aa4b8ccd8e0_NeikiAnalytics.exe
Size

79KB
MD5

388b4ddf4aa8a8077b820aa4b8ccd8e0
SHA1

23772925327b32051df985011f5742717e96fffa
SHA256

af80572a06f545033a93cb4a85f8113fcf5842da61e416db4373f1ac2dedd95d
SHA512

29863d79ee4b8c258a5173f3f0ae67e1fcf26e7199969563f72f640d6c884b5286bacee48132182314892f1040b898491cb4ed6aefef98b300c65e54573f0904
SSDEEP

1536:zvBhcIFGoQftrSOQA8AkqUhMb2nuy5wgIP0CSJ+5yeB8GMGlZ5G:zvqrXGdqU7uy5w9WMyeN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1268	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2292	cmd.exe
2292	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2292	3000	388b4ddf4aa8a8077b820aa4b8ccd8e0_NeikiAnalytics.exe	29
PID 3000 wrote to memory of 2292	3000	388b4ddf4aa8a8077b820aa4b8ccd8e0_NeikiAnalytics.exe	29
PID 3000 wrote to memory of 2292	3000	388b4ddf4aa8a8077b820aa4b8ccd8e0_NeikiAnalytics.exe	29
PID 3000 wrote to memory of 2292	3000	388b4ddf4aa8a8077b820aa4b8ccd8e0_NeikiAnalytics.exe	29
PID 2292 wrote to memory of 1268	2292	cmd.exe	30
PID 2292 wrote to memory of 1268	2292	cmd.exe	30
PID 2292 wrote to memory of 1268	2292	cmd.exe	30
PID 2292 wrote to memory of 1268	2292	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\388b4ddf4aa8a8077b820aa4b8ccd8e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\388b4ddf4aa8a8077b820aa4b8ccd8e0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:1268

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
973867665c78ab39798ed67030b05de0

SHA1
6872ccee2e76a920a3d44c704a21dc70244b6dbf

SHA256
269195ba3019ae039635bded387945355c249b26b4f90668ea11f23418d400b1

SHA512
33a12d76cebeba41aaf673c4c8df9b04adf8fadb32f725c946f3f9bf35c80c553c411aa87b85009f93cbf2b4fa53fb0d396213fc9e9e0c1bb34d9a4786e01375

Download Submit
memory/1268-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3000-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download