4c9077cdc5a3dbc94a922d1731628a7a842b13ca45b3d32fda0821e0a8bc1cb2

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 12:16

Target

5341bfed8b001e94915746c1081ffad0_NeikiAnalytics.exe
Size

79KB
MD5

5341bfed8b001e94915746c1081ffad0
SHA1

7c980a39646ef678175597afb09f1896ebc54b35
SHA256

4c9077cdc5a3dbc94a922d1731628a7a842b13ca45b3d32fda0821e0a8bc1cb2
SHA512

41c22bb546e43c8acf58da1d66691249cb38f9fcfae425baef777df9bc758972ac453c33199f3b9506a823a73f9f7d0336396485d6e2967e4925da05ec42b77f
SSDEEP

1536:zvYXfWmBA7mSJoFrOQA8AkqUhMb2nuy5wgIP0CSJ+5yVB8GMGlZ5G:zvYROd06GdqU7uy5w9WMyVN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2632	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
1832	cmd.exe
1832	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 1832	2108	5341bfed8b001e94915746c1081ffad0_NeikiAnalytics.exe	29
PID 2108 wrote to memory of 1832	2108	5341bfed8b001e94915746c1081ffad0_NeikiAnalytics.exe	29
PID 2108 wrote to memory of 1832	2108	5341bfed8b001e94915746c1081ffad0_NeikiAnalytics.exe	29
PID 2108 wrote to memory of 1832	2108	5341bfed8b001e94915746c1081ffad0_NeikiAnalytics.exe	29
PID 1832 wrote to memory of 2632	1832	cmd.exe	30
PID 1832 wrote to memory of 2632	1832	cmd.exe	30
PID 1832 wrote to memory of 2632	1832	cmd.exe	30
PID 1832 wrote to memory of 2632	1832	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\5341bfed8b001e94915746c1081ffad0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5341bfed8b001e94915746c1081ffad0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2632

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
79ffbccf4d78ea15ee3829a3409121a5

SHA1
bbf382201fdfd3d73b45ee268e1ab40fbc7b4915

SHA256
81152fdbeb3577bc7a923a0dd4d529041b0064914ee294aafc64503c31063350

SHA512
c9c016fc64b2d8859fbbdac3a5e4bc007d6f4ea69c2779158ad20e9418ab69b1ac91987db770aad89f4ad67ad15e8bac65913b2343bb3a1382126c99115084eb

Download Submit
memory/2108-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2632-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download