1c441e2bdc3a19a72b39c6c6a849f4f79b97b8b33aa8a9759297d32fb3157872

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 02:58

Target

32fe175622804629af023deb92e388c0_NeikiAnalytics.exe
Size

73KB
MD5

32fe175622804629af023deb92e388c0
SHA1

d5603af046d01e5b145bc37df517dca8705313ed
SHA256

1c441e2bdc3a19a72b39c6c6a849f4f79b97b8b33aa8a9759297d32fb3157872
SHA512

bd592e5815f2c3fa8a7f66b46ffaa8715c93c7bae7e81eebfef62a9a9585a53219695a3c5af0a91744fbfc39741ba8639a1fff0748ea4e340ee33513c6a8c032
SSDEEP

1536:hbqOn7zGNAruK5QPqfhVWbdsmA+RjPFLC+e5hF0ZGUGf2g:h2On5aNPqfcxA+HFshFOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2108	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
3004	cmd.exe
3004	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 3004	2872	32fe175622804629af023deb92e388c0_NeikiAnalytics.exe	29
PID 2872 wrote to memory of 3004	2872	32fe175622804629af023deb92e388c0_NeikiAnalytics.exe	29
PID 2872 wrote to memory of 3004	2872	32fe175622804629af023deb92e388c0_NeikiAnalytics.exe	29
PID 2872 wrote to memory of 3004	2872	32fe175622804629af023deb92e388c0_NeikiAnalytics.exe	29
PID 3004 wrote to memory of 2108	3004	cmd.exe	30
PID 3004 wrote to memory of 2108	3004	cmd.exe	30
PID 3004 wrote to memory of 2108	3004	cmd.exe	30
PID 3004 wrote to memory of 2108	3004	cmd.exe	30
PID 2108 wrote to memory of 2636	2108	[email protected]	31
PID 2108 wrote to memory of 2636	2108	[email protected]	31
PID 2108 wrote to memory of 2636	2108	[email protected]	31
PID 2108 wrote to memory of 2636	2108	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\32fe175622804629af023deb92e388c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\32fe175622804629af023deb92e388c0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2108
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2636

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
19f26d40af57a58a1fc4f4da29daee60

SHA1
7cebfc6cbc57714e9d78afcfb6af1175dd295ab5

SHA256
ed089f587bdeee3131c8749d7bdc34ae84ad5920c67ee0205a6f5e19edbd6c67

SHA512
5de2365abe70e1c175e657b098c42203da515644aeb9594f67cb17b9a9b1c33a8642f7cb0111a82bce68926ef27ce0474831f5495abc2f5afcbdeb25c86ebad1

Download Submit
memory/2108-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2872-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download