79d093ad33ee4cdf64ffd9607156606b2f572018c7f8bae41e6df2e5f1d07e68

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 10:27

Target
512d7cbd82e0af0fa10d5421ac5f11e0_NeikiAnalytics.exe
Size 73KB
Sample240529-mg9pyacc33
SHA256 79d093ad33ee4cdf64ffd9607156606b2f572018c7f8bae41e6df2e5f1d07e68
MD5 512d7cbd82e0af0fa10d5421ac5f11e0
SHA1 1a1728634ec871135fa3af78fb8ab6e8e64d3809
SHA512 b2cb85db58f9b118a44769d9f336bfe1f0af64b330880b8705db7016955982d15fb3e36c35bc02dd6bde87da596c5827682b060b8b0f9863d306e077ff0133f8
SSDEEP 1536:hbyfGPRcsfK5QPqfhVWbdsmA+RjPFLC+e5hl0ZGUGf2g:h+fG9NPqfcxA+HFshlOg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2992	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
1912	cmd.exe
1912	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 1912	3012	512d7cbd82e0af0fa10d5421ac5f11e0_NeikiAnalytics.exe	29
PID 3012 wrote to memory of 1912	3012	512d7cbd82e0af0fa10d5421ac5f11e0_NeikiAnalytics.exe	29
PID 3012 wrote to memory of 1912	3012	512d7cbd82e0af0fa10d5421ac5f11e0_NeikiAnalytics.exe	29
PID 3012 wrote to memory of 1912	3012	512d7cbd82e0af0fa10d5421ac5f11e0_NeikiAnalytics.exe	29
PID 1912 wrote to memory of 2992	1912	cmd.exe	30
PID 1912 wrote to memory of 2992	1912	cmd.exe	30
PID 1912 wrote to memory of 2992	1912	cmd.exe	30
PID 1912 wrote to memory of 2992	1912	cmd.exe	30
PID 2992 wrote to memory of 1208	2992	[email protected]	31
PID 2992 wrote to memory of 1208	2992	[email protected]	31
PID 2992 wrote to memory of 1208	2992	[email protected]	31
PID 2992 wrote to memory of 1208	2992	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\512d7cbd82e0af0fa10d5421ac5f11e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\512d7cbd82e0af0fa10d5421ac5f11e0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2992
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:1208

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 73KB
SHA256 c7701833b89b3660a1d8c066eefc9c4c764f0fdadc1300aefc385c806e2b7088
MD5 d3eeb4762e5c232e41b3ba1fddcc7100
SHA1 d0681316c8af868e55eb89635680c75ec39e1eee
SHA512 65c6b3f8bb7ca0514417c9ec4cd875614b46c41e9862537a9ced28ac3f2670fffd88ec9f94e448941dac71d84529319479903f103bb3a880759c50c0c8b6d0c9
SSDEEP 1536:hbSYv9ZK5QPqfhVWbdsmA+RjPFLC+e5hN0ZGUGf2g:hGYvHNPqfcxA+HFshNOg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2992-10-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/3012-11-0x0000000000400000-0x0000000000419000-memory.dmp

Download