49bde1bdae6e086fdad0dd2aa305d28ca95a765078c77074612666ce4e53370d

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 23:31

Target

6d0a5282a3bdc5a983c8380edb8a8bc0_NeikiAnalytics.exe
Size

73KB
MD5

6d0a5282a3bdc5a983c8380edb8a8bc0
SHA1

a579395ef205096eaea3f1779369b2996b7c1d0d
SHA256

49bde1bdae6e086fdad0dd2aa305d28ca95a765078c77074612666ce4e53370d
SHA512

6982ecc4214fdb4b2d310c78ca3d80a19f5c5e1a1bafce7f1c82abeee5915be3e6e60a6190fcb99594963d151537b4695f4030b6b1c3d980e2d9359c867e79b7
SSDEEP

1536:hbenS1B1lQd4K5QPqfhVWbdsmA+RjPFLC+e5hQT0ZGUGf2g:hCSL1lQiNPqfcxA+HFshQTOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3048	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2700	cmd.exe
2700	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2700	2204	6d0a5282a3bdc5a983c8380edb8a8bc0_NeikiAnalytics.exe	29
PID 2204 wrote to memory of 2700	2204	6d0a5282a3bdc5a983c8380edb8a8bc0_NeikiAnalytics.exe	29
PID 2204 wrote to memory of 2700	2204	6d0a5282a3bdc5a983c8380edb8a8bc0_NeikiAnalytics.exe	29
PID 2204 wrote to memory of 2700	2204	6d0a5282a3bdc5a983c8380edb8a8bc0_NeikiAnalytics.exe	29
PID 2700 wrote to memory of 3048	2700	cmd.exe	30
PID 2700 wrote to memory of 3048	2700	cmd.exe	30
PID 2700 wrote to memory of 3048	2700	cmd.exe	30
PID 2700 wrote to memory of 3048	2700	cmd.exe	30
PID 3048 wrote to memory of 2524	3048	[email protected]	31
PID 3048 wrote to memory of 2524	3048	[email protected]	31
PID 3048 wrote to memory of 2524	3048	[email protected]	31
PID 3048 wrote to memory of 2524	3048	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\6d0a5282a3bdc5a983c8380edb8a8bc0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6d0a5282a3bdc5a983c8380edb8a8bc0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 16256.exe
      4⤵
      PID:2524

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
c2e895e61a2ea3c573549049aab98cc8

SHA1
c562edfadcdf7f171695bbd308e7ef2f649c450b

SHA256
2dbeaca55cf494c69e179118c0e29c9b0950a09f87b2fa6b949b25511c268cdc

SHA512
7eec78e08ba91d2da63f3f22cbe4086ab587daff9164451115c06660e63998b5b3ecf5fe631ceedab4d09af944742cda502e17ec0fec231452ca0278f2f08343

Download Submit
memory/2204-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3048-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download