98fa2e390742dca1a7e0e718056e66e01007216fd974281a3bad9fbccc637291

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 09:19

Target

4ee95ffbe5ad3a680882d00fc9be4a70_NeikiAnalytics.exe
Size

79KB
MD5

4ee95ffbe5ad3a680882d00fc9be4a70
SHA1

50590a90efa5b578136c1685d34c73981dfcca93
SHA256

98fa2e390742dca1a7e0e718056e66e01007216fd974281a3bad9fbccc637291
SHA512

e79a7cf23b20a7ffed8991b28bdc48dae2e57843cdd5bba2e781409f6033998d2208faadcbf3f1aad85593729b821ccfa431c63c2794dec57c9139fe83fdb4c3
SSDEEP

1536:zv4au8qeCIW7WU8ikh4OQA8AkqUhMb2nuy5wgIP0CSJ+5ydYB8GMGlZ5G:zvkzvIbHZhdGdqU7uy5w9WMyyN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2552	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2744	cmd.exe
2744	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 2744	1608	4ee95ffbe5ad3a680882d00fc9be4a70_NeikiAnalytics.exe	29
PID 1608 wrote to memory of 2744	1608	4ee95ffbe5ad3a680882d00fc9be4a70_NeikiAnalytics.exe	29
PID 1608 wrote to memory of 2744	1608	4ee95ffbe5ad3a680882d00fc9be4a70_NeikiAnalytics.exe	29
PID 1608 wrote to memory of 2744	1608	4ee95ffbe5ad3a680882d00fc9be4a70_NeikiAnalytics.exe	29
PID 2744 wrote to memory of 2552	2744	cmd.exe	30
PID 2744 wrote to memory of 2552	2744	cmd.exe	30
PID 2744 wrote to memory of 2552	2744	cmd.exe	30
PID 2744 wrote to memory of 2552	2744	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\4ee95ffbe5ad3a680882d00fc9be4a70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4ee95ffbe5ad3a680882d00fc9be4a70_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2552

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
4d14a87f5f8023f606d789b08f6d5ced

SHA1
9f889d1d048a050a25da6ccb78cd2db0f2eb720e

SHA256
dbf30fa67b966318451433f4dc4e6b07197079f04fc1cda36382983256b5ef66

SHA512
34fb0b916a98ff17c4ae8f95bf3d1fdc654530fd1a113092b10b2a8ac39b6afe23e447c3f19eb3d4829c94fc60be1d5e5da2707f5d2f544e27e90c1d0e548c59

Download Submit
memory/1608-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2552-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download