e0d9a60c242de0388a96bc310205240d2bc72d2dfecd602353311b69675f4d54

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 10:45

Target
51c408d6ef1eb0024dbae616f4d44020_NeikiAnalytics.exe
Size 79KB
Sample240529-mthf8acf74
SHA256 e0d9a60c242de0388a96bc310205240d2bc72d2dfecd602353311b69675f4d54
MD5 51c408d6ef1eb0024dbae616f4d44020
SHA1 84e2faf1227ad7b739656f5df699e3279952a434
SHA512 220348776cea95b60f92eed800d9473403b9f4920b26df3765fc9cd472556e0f34d2bf3b3aec1022d1752b7fde39c1b0bd02fd438198eb6d41cc9f5163124ab1
SSDEEP 1536:zv8QIQ3v5DsdOQA8AkqUhMb2nuy5wgIP0CSJ+5yZB8GMGlZ5G:zv9d3OEGdqU7uy5w9WMyZN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1788	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2260	cmd.exe
2260	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2260	2428	51c408d6ef1eb0024dbae616f4d44020_NeikiAnalytics.exe	29
PID 2428 wrote to memory of 2260	2428	51c408d6ef1eb0024dbae616f4d44020_NeikiAnalytics.exe	29
PID 2428 wrote to memory of 2260	2428	51c408d6ef1eb0024dbae616f4d44020_NeikiAnalytics.exe	29
PID 2428 wrote to memory of 2260	2428	51c408d6ef1eb0024dbae616f4d44020_NeikiAnalytics.exe	29
PID 2260 wrote to memory of 1788	2260	cmd.exe	30
PID 2260 wrote to memory of 1788	2260	cmd.exe	30
PID 2260 wrote to memory of 1788	2260	cmd.exe	30
PID 2260 wrote to memory of 1788	2260	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\51c408d6ef1eb0024dbae616f4d44020_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\51c408d6ef1eb0024dbae616f4d44020_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:1788

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 783ba38ef08151d341d3dd05ded082789695531971a2ac580ba48304daef5a68
MD5 57f0a56783db2e2fbde5fa650b7ffde8
SHA1 eb19bea3b8bbb96c14cefe58c635688884058b74
SHA512 af4d2daf1577ca3194ab50d8df4f0a53e60db27046061511b20c9f77d978c5545ba916b7440f10e98e763499d8e0f32a699eb3fddd324152601be1488355963e
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5yRB8GMGlZ5G:zv+vTpGdqU7uy5w9WMyRN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1788-7-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2428-8-0x0000000000400000-0x000000000041B000-memory.dmp

Download