b0f4aa196c1c31bdcfeb7509d22a67cf8d513560d3af987ac21290e1616e72ef

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 11:44

Target

423ea0ced082b1ff19a12f57029fe9b0_NeikiAnalytics.exe
Size

79KB
MD5

423ea0ced082b1ff19a12f57029fe9b0
SHA1

6da1e5b6cb4836a69d1a04d394773deabe3e0658
SHA256

b0f4aa196c1c31bdcfeb7509d22a67cf8d513560d3af987ac21290e1616e72ef
SHA512

fdf6c30eabea3af4202967828e35167bca2d83f6160c00a9445b997b0195c9c55cb6b280ab68cfada790206408cd2effc86bec413c4c76461abc048003e63207
SSDEEP

1536:zvJudrqrpLekL5OQA8AkqUhMb2nuy5wgIP0CSJ+5yJB8GMGlZ5G:zvJu0rpLXUGdqU7uy5w9WMyJN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2288	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
620	cmd.exe
620	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 620	2208	423ea0ced082b1ff19a12f57029fe9b0_NeikiAnalytics.exe	29
PID 2208 wrote to memory of 620	2208	423ea0ced082b1ff19a12f57029fe9b0_NeikiAnalytics.exe	29
PID 2208 wrote to memory of 620	2208	423ea0ced082b1ff19a12f57029fe9b0_NeikiAnalytics.exe	29
PID 2208 wrote to memory of 620	2208	423ea0ced082b1ff19a12f57029fe9b0_NeikiAnalytics.exe	29
PID 620 wrote to memory of 2288	620	cmd.exe	30
PID 620 wrote to memory of 2288	620	cmd.exe	30
PID 620 wrote to memory of 2288	620	cmd.exe	30
PID 620 wrote to memory of 2288	620	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\423ea0ced082b1ff19a12f57029fe9b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\423ea0ced082b1ff19a12f57029fe9b0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:620
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2288

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
bb891c5005f7fac50925126052d6ee39

SHA1
1bc00941b54856f09ac405c009ba2861067d8f5e

SHA256
b9d53a6e15d1bef86d1fb5c5c0a933d736828d1d7e690a2f1711579c443b4db3

SHA512
9dbcce7951ccc5f220cc3a9225cc154f00c95e0d7a56c4bb7c1f7bb271face40320b7755a0e9b2311915490912b57e564e9d8eee54a94df377232a471a28544b

Download Submit
memory/2208-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2288-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download