79ea8b75d1488fcd0639c53bf0faa5f6608a97f58aceca8249ba105f3a84c505

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 07:56

Target

4bc22d9470781e50a2b14e7275ec2b90_NeikiAnalytics.exe
Size

79KB
MD5

4bc22d9470781e50a2b14e7275ec2b90
SHA1

9b525fa50f45110803504ec7f750d202d4cccb4a
SHA256

79ea8b75d1488fcd0639c53bf0faa5f6608a97f58aceca8249ba105f3a84c505
SHA512

5512a978286378d0b9ee7724854b26925f2f74e8c93c534c2a44bb68845517bfacf6c12fd8597cb90a9f2757757bbaa456e2e405a8f4f5de49224166b2a7986e
SSDEEP

1536:zvXObzfMmFJA4r0BOQA8AkqUhMb2nuy5wgIP0CSJ+5ydB8GMGlZ5G:zvXOnkmw4rdGdqU7uy5w9WMydN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2936	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2988	cmd.exe
2988	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2988	2360	4bc22d9470781e50a2b14e7275ec2b90_NeikiAnalytics.exe	29
PID 2360 wrote to memory of 2988	2360	4bc22d9470781e50a2b14e7275ec2b90_NeikiAnalytics.exe	29
PID 2360 wrote to memory of 2988	2360	4bc22d9470781e50a2b14e7275ec2b90_NeikiAnalytics.exe	29
PID 2360 wrote to memory of 2988	2360	4bc22d9470781e50a2b14e7275ec2b90_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2936	2988	cmd.exe	30
PID 2988 wrote to memory of 2936	2988	cmd.exe	30
PID 2988 wrote to memory of 2936	2988	cmd.exe	30
PID 2988 wrote to memory of 2936	2988	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\4bc22d9470781e50a2b14e7275ec2b90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4bc22d9470781e50a2b14e7275ec2b90_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2936

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
98d0fcde5fc46cf046499d1abb616d35

SHA1
07016996046f5a80193631b147aa5cc74e07bfc8

SHA256
4e25620d595beae0fde72114b4f818ec333eeb54e946286401b2bdd9b60c25f5

SHA512
c6c2e5201812e3ef7d312c3a95a821a3542b557b2bea74e05c045a06587bf46edc5b6ca0c54c2fd928f474eaac184c8f4af0898d92d5226e19051acb0a0b60fa

Download Submit
memory/2360-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2936-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download