b5b353587eeaecc2f56347c3afc093672d4c0eacc93343571202c2385b00ddcb

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 00:38

Target

5cc0f6bdf653867b342c054f54d48650_NeikiAnalytics.exe
Size

79KB
MD5

5cc0f6bdf653867b342c054f54d48650
SHA1

a58124c00e16b86f8a0ee4bd827cc09ec4ce5cb3
SHA256

b5b353587eeaecc2f56347c3afc093672d4c0eacc93343571202c2385b00ddcb
SHA512

597f616aecc67620f1377718fa3e322e87c23589829b1f45dd66e6c57542a48314f89b414d7faa7fefb14e5c830dde52f799e21eade252282a37cb1cf80f484d
SSDEEP

1536:zvv/UY9AxlNIniBKOQA8AkqUhMb2nuy5wgIP0CSJ+5ypB8GMGlZ5G:zv3UG0l6niBGdqU7uy5w9WMypN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1940	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2332	cmd.exe
2332	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2332	2076	5cc0f6bdf653867b342c054f54d48650_NeikiAnalytics.exe	29
PID 2076 wrote to memory of 2332	2076	5cc0f6bdf653867b342c054f54d48650_NeikiAnalytics.exe	29
PID 2076 wrote to memory of 2332	2076	5cc0f6bdf653867b342c054f54d48650_NeikiAnalytics.exe	29
PID 2076 wrote to memory of 2332	2076	5cc0f6bdf653867b342c054f54d48650_NeikiAnalytics.exe	29
PID 2332 wrote to memory of 1940	2332	cmd.exe	30
PID 2332 wrote to memory of 1940	2332	cmd.exe	30
PID 2332 wrote to memory of 1940	2332	cmd.exe	30
PID 2332 wrote to memory of 1940	2332	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\5cc0f6bdf653867b342c054f54d48650_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5cc0f6bdf653867b342c054f54d48650_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:1940

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
2c9cd0fabac74a7a3a5af250d2c055f5

SHA1
c171ac393ecb462004a9b1a563d9f51710365760

SHA256
ea9e699c19af764981510e3be8bc24b6769a7f1d0cb8eb1d13c98b94c1550fd9

SHA512
4226d6e304c26ee2e824093525696bdd358f922b8a73843473aced47306839f7b70b325c2ba18ca10f718bc340e761f0a939b2fa00c93632d5f7447efd48734e

Download Submit
memory/1940-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2076-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download