e6d6391ebbb29c2d507dfc7906bd7c700ddd0d954fb035cc095038e89b04d207

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 08:32

Target

4d139c86eb5af31da767889e6b2d6940_NeikiAnalytics.exe
Size

79KB
MD5

4d139c86eb5af31da767889e6b2d6940
SHA1

8df8b3ffe03450e61eff29160f278e6cf139a193
SHA256

e6d6391ebbb29c2d507dfc7906bd7c700ddd0d954fb035cc095038e89b04d207
SHA512

bbb4cd39e65e433ef1c6542296483dd79dc31823dcdca667e0a9c0064fe0c4904dcbb7fcef918d499a227f4b3bf63446fc1d1e09d9611c1d6118b11f2b40fee1
SSDEEP

1536:zvRU/6U59JOQA8AkqUhMb2nuy5wgIP0CSJ+5ycB8GMGlZ5G:zvRO6ULIGdqU7uy5w9WMycN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1224	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2416	cmd.exe
2416	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2416	1876	4d139c86eb5af31da767889e6b2d6940_NeikiAnalytics.exe	29
PID 1876 wrote to memory of 2416	1876	4d139c86eb5af31da767889e6b2d6940_NeikiAnalytics.exe	29
PID 1876 wrote to memory of 2416	1876	4d139c86eb5af31da767889e6b2d6940_NeikiAnalytics.exe	29
PID 1876 wrote to memory of 2416	1876	4d139c86eb5af31da767889e6b2d6940_NeikiAnalytics.exe	29
PID 2416 wrote to memory of 1224	2416	cmd.exe	30
PID 2416 wrote to memory of 1224	2416	cmd.exe	30
PID 2416 wrote to memory of 1224	2416	cmd.exe	30
PID 2416 wrote to memory of 1224	2416	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\4d139c86eb5af31da767889e6b2d6940_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4d139c86eb5af31da767889e6b2d6940_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:1224

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
4999981c5e8d053015c02b3efe12c853

SHA1
627f3445ea5bb4fc73420168c96bf2e23556deb9

SHA256
5e62cd11163931ad01e2da24929825103ba2378f8aee17fd569a23f3d88062b6

SHA512
e36fb318999158b30ff0d23d27be0ee004236f77d854b71ab6baa00a7fe15fc0b7294f34e6cb805a43d1240a71f4dda21496d72965082b5ef9dec150adb58a40

Download Submit
memory/1224-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1876-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download