835438a11dc42e9a4da4c54b54846c612a77301b70b3eb76ba88762f916fcee3

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 21:10

Target

06da5290157aa37434ee977fc69273f0_NeikiAnalytics.exe
Size

73KB
MD5

06da5290157aa37434ee977fc69273f0
SHA1

795887d0e5c0156a09da9aacbcd356704beff657
SHA256

835438a11dc42e9a4da4c54b54846c612a77301b70b3eb76ba88762f916fcee3
SHA512

44fe7a9eb0a63b72b15c8e58cf782adf5299e589ca49b2b8a971493799ea2eabe5d2e4f5a2009a4344de4719e9d1f1d790171c815a2f3472f85d6591c67b6db4
SSDEEP

1536:hbb0lxBRoeykzpWUOK5QPqfhVWbdsmA+RjPFLC+e5hR0ZGUGf2g:hHsRoZupWUONPqfcxA+HFshROg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1212	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2240	cmd.exe
2240	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2240	1740	06da5290157aa37434ee977fc69273f0_NeikiAnalytics.exe	29
PID 1740 wrote to memory of 2240	1740	06da5290157aa37434ee977fc69273f0_NeikiAnalytics.exe	29
PID 1740 wrote to memory of 2240	1740	06da5290157aa37434ee977fc69273f0_NeikiAnalytics.exe	29
PID 1740 wrote to memory of 2240	1740	06da5290157aa37434ee977fc69273f0_NeikiAnalytics.exe	29
PID 2240 wrote to memory of 1212	2240	cmd.exe	30
PID 2240 wrote to memory of 1212	2240	cmd.exe	30
PID 2240 wrote to memory of 1212	2240	cmd.exe	30
PID 2240 wrote to memory of 1212	2240	cmd.exe	30
PID 1212 wrote to memory of 2680	1212	[email protected]	31
PID 1212 wrote to memory of 2680	1212	[email protected]	31
PID 1212 wrote to memory of 2680	1212	[email protected]	31
PID 1212 wrote to memory of 2680	1212	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\06da5290157aa37434ee977fc69273f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\06da5290157aa37434ee977fc69273f0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1212
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2680

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
989928813e5337a8ea57d5dcceddb9e2

SHA1
9786bbff780927a3d9748473ab9bcfd50941c2ff

SHA256
509c5741287c91673591f60194368fae4b394a49bee569f685ce05c63c42404e

SHA512
3547abd2ba5a6336a6be0bcf6d788d881216977e3f42434f27a259a52deb5242c26678d2c31dbde2505e2f18bcbaec59c3d671edbd028fedf0e105d77394b619

Download Submit
memory/1212-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1740-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download