dbb81217555f456eb9daec4d94763c90b02fa5e82af9a0fe73e76f127d9f8ad5

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 02:45

Target

6118e23e3b3534f3978c48f2aed33a00_NeikiAnalytics.exe
Size

73KB
MD5

6118e23e3b3534f3978c48f2aed33a00
SHA1

a96506b9331fd336bd661467da1737a0a1b02fbb
SHA256

dbb81217555f456eb9daec4d94763c90b02fa5e82af9a0fe73e76f127d9f8ad5
SHA512

a726c33737484e1241cd4b6439793a5d3afe9de59256a7d4fe723c09d279a1be22d2c567afd6a257b3e3061585060fb30604ceab21b2a86c2662d401c514c47c
SSDEEP

1536:hbXV7mu9bXPK5QPqfhVWbdsmA+RjPFLC+e5htQ0ZGUGf2g:hrVrbXPNPqfcxA+HFsh6Og

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2912	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2196	cmd.exe
2196	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2196	1964	6118e23e3b3534f3978c48f2aed33a00_NeikiAnalytics.exe	29
PID 1964 wrote to memory of 2196	1964	6118e23e3b3534f3978c48f2aed33a00_NeikiAnalytics.exe	29
PID 1964 wrote to memory of 2196	1964	6118e23e3b3534f3978c48f2aed33a00_NeikiAnalytics.exe	29
PID 1964 wrote to memory of 2196	1964	6118e23e3b3534f3978c48f2aed33a00_NeikiAnalytics.exe	29
PID 2196 wrote to memory of 2912	2196	cmd.exe	30
PID 2196 wrote to memory of 2912	2196	cmd.exe	30
PID 2196 wrote to memory of 2912	2196	cmd.exe	30
PID 2196 wrote to memory of 2912	2196	cmd.exe	30
PID 2912 wrote to memory of 2512	2912	[email protected]	31
PID 2912 wrote to memory of 2512	2912	[email protected]	31
PID 2912 wrote to memory of 2512	2912	[email protected]	31
PID 2912 wrote to memory of 2512	2912	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\6118e23e3b3534f3978c48f2aed33a00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6118e23e3b3534f3978c48f2aed33a00_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2512

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
786cebd4157c8fb4a83a3173048f5ff0

SHA1
c18364e177529b8dfb871d6018912d0b8fe638b9

SHA256
4d200c16b2b8e5a9d1b12c7620711b7ce8bd7bb986cb79ba96f071b1261492e9

SHA512
9a69b61f6192ef8fb83c9244760b70c7afcc5eaddb673ebea6801bf163b4d0efd07cb9c875cf56aa877d7ca69e1789bfee899feb5d18fb288c6b1e0cc7c4ef28

Download Submit
memory/1964-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2912-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download