febad25845e9c93420cffb687f5e0bb0697d5c0e32a3d8ece228f7835cf6b032

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 01:56

Target
5f83f4ce17879cb85a92ec591652b4d0_NeikiAnalytics.exe
Size 79KB
Sample240530-ccvecaad4s
SHA256 febad25845e9c93420cffb687f5e0bb0697d5c0e32a3d8ece228f7835cf6b032
MD5 5f83f4ce17879cb85a92ec591652b4d0
SHA1 1142de7754434ffd14c3fc18b312be9cafb6be17
SHA512 8fa92a05aece05ea84e817ab70f4ba39dbd5e91ed0600880dfdd72b6328b0347e1c18f4b07ab464c4b1b4e103564620ff9a71f769761a10a1310d3bea59a148b
SSDEEP 1536:zvPT7ruRzznVLxXJOQA8AkqUhMb2nuy5wgIP0CSJ+5yDB8GMGlZ5G:zvPXEzxdIGdqU7uy5w9WMyDN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2152	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2308	cmd.exe
2308	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2308	2236	5f83f4ce17879cb85a92ec591652b4d0_NeikiAnalytics.exe	29
PID 2236 wrote to memory of 2308	2236	5f83f4ce17879cb85a92ec591652b4d0_NeikiAnalytics.exe	29
PID 2236 wrote to memory of 2308	2236	5f83f4ce17879cb85a92ec591652b4d0_NeikiAnalytics.exe	29
PID 2236 wrote to memory of 2308	2236	5f83f4ce17879cb85a92ec591652b4d0_NeikiAnalytics.exe	29
PID 2308 wrote to memory of 2152	2308	cmd.exe	30
PID 2308 wrote to memory of 2152	2308	cmd.exe	30
PID 2308 wrote to memory of 2152	2308	cmd.exe	30
PID 2308 wrote to memory of 2152	2308	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\5f83f4ce17879cb85a92ec591652b4d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5f83f4ce17879cb85a92ec591652b4d0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2152

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 076b7e9db0be35c6faa9dacb58f55b0dfbbee02bdbe705ea5a0cef7e2fc53548
MD5 76c0706b79d72cdcb201dac8d40fd1ec
SHA1 61e25b2c7996ccb77119c3031dbb8c2d1b00ed3d
SHA512 544d1a5c7e45f1dd75ff317e73ca1cc380f9a2940dd9cf9bdc87b7cba3d974c0cc316c6ee60e586192c81d78072ebbf29c59e6a0f96aee5ac3cd947c9e60cdf1
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5y/B8GMGlZ5G:zv+vTpGdqU7uy5w9WMy/N5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2152-7-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2236-8-0x0000000000400000-0x000000000041B000-memory.dmp

Download