7a4d9fc9aab51125d3b931a19f9f44df65ca7f9322a93f4b53ef866c3933b34b

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 21:29

Target

5648dd63870a6a9593cd4b9a83d98ce0_NeikiAnalytics.exe
Size

79KB
MD5

5648dd63870a6a9593cd4b9a83d98ce0
SHA1

11b802c4305416faf39a3fb37c0b9ed27d372a5c
SHA256

7a4d9fc9aab51125d3b931a19f9f44df65ca7f9322a93f4b53ef866c3933b34b
SHA512

36d2c600d4e96e86366c2e3a25379040f3e3c458510f89be48f2eb245a63157f5299c95924111dfcf39c52ea54793dc6ebbd0cedfc11febffdae7c7e294ca283
SSDEEP

1536:zvpySxR4aEN4w0CP3YwhOQA8AkqUhMb2nuy5wgIP0CSJ+5yzB8GMGlZ5G:zvzxcpWJGdqU7uy5w9WMyzN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2464	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2984	cmd.exe
2984	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2984	2100	5648dd63870a6a9593cd4b9a83d98ce0_NeikiAnalytics.exe	29
PID 2100 wrote to memory of 2984	2100	5648dd63870a6a9593cd4b9a83d98ce0_NeikiAnalytics.exe	29
PID 2100 wrote to memory of 2984	2100	5648dd63870a6a9593cd4b9a83d98ce0_NeikiAnalytics.exe	29
PID 2100 wrote to memory of 2984	2100	5648dd63870a6a9593cd4b9a83d98ce0_NeikiAnalytics.exe	29
PID 2984 wrote to memory of 2464	2984	cmd.exe	30
PID 2984 wrote to memory of 2464	2984	cmd.exe	30
PID 2984 wrote to memory of 2464	2984	cmd.exe	30
PID 2984 wrote to memory of 2464	2984	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\5648dd63870a6a9593cd4b9a83d98ce0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5648dd63870a6a9593cd4b9a83d98ce0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2464

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
cf596466e341ef9461271a7886b8cca4

SHA1
abe950f75157473da4ac7b4453346e9dd4ae8f13

SHA256
36fdb3616a0fed1db61754ff8b02daf5168b2f903fa4d8d5e57b8301ec9c2b2d

SHA512
22464b3a4d32c28705a4544e79409b4ebf568edba5ffccc0461c2fe2c11fda92a02d0c6ce08aec66ff49e2e0b9ef634635e5421099971f6de6c39f2fd3a0e782

Download Submit
memory/2100-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2464-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download