8c4ad780c3bf803e1d2d58ffd1984082f4e9cfae57ea0e197b5746fa65bd808c

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 04:10

Target
63d74ac262b97c700d21374df60bb160_NeikiAnalytics.exe
Size 73KB
Sample240530-errccaea5y
SHA256 8c4ad780c3bf803e1d2d58ffd1984082f4e9cfae57ea0e197b5746fa65bd808c
MD5 63d74ac262b97c700d21374df60bb160
SHA1 5e874f8b5ff022d928c3338991544671b4e7a598
SHA512 038e46561ad1eee822bad80c85df76966f2d987964cec63d75cfd89517beb9c312474f8755a7946a4075b396676279cae755b76978e2c22aec76f53f30e906bb
SSDEEP 1536:hbyj/7u79TnnR7K5QPqfhVWbdsmA+RjPFLC+e5ho0ZGUGf2g:h+j/7Cl7NPqfcxA+HFshoOg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1220	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
1936	cmd.exe
1936	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 1936	2576	63d74ac262b97c700d21374df60bb160_NeikiAnalytics.exe	29
PID 2576 wrote to memory of 1936	2576	63d74ac262b97c700d21374df60bb160_NeikiAnalytics.exe	29
PID 2576 wrote to memory of 1936	2576	63d74ac262b97c700d21374df60bb160_NeikiAnalytics.exe	29
PID 2576 wrote to memory of 1936	2576	63d74ac262b97c700d21374df60bb160_NeikiAnalytics.exe	29
PID 1936 wrote to memory of 1220	1936	cmd.exe	30
PID 1936 wrote to memory of 1220	1936	cmd.exe	30
PID 1936 wrote to memory of 1220	1936	cmd.exe	30
PID 1936 wrote to memory of 1220	1936	cmd.exe	30
PID 1220 wrote to memory of 2260	1220	[email protected]	31
PID 1220 wrote to memory of 2260	1220	[email protected]	31
PID 1220 wrote to memory of 2260	1220	[email protected]	31
PID 1220 wrote to memory of 2260	1220	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\63d74ac262b97c700d21374df60bb160_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\63d74ac262b97c700d21374df60bb160_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1220
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2260

Path \Users\Admin\AppData\Local\Temp\[email protected]
Size 73KB
SHA256 e3b936bd8753c1c4004e891ed4ef5eb6f18a600636ea8dfe36b54941a784ae3f
MD5 b0c22b369857308d7b6ceb582cdd3399
SHA1 4ddf777daa75cc0966107e1544263735c183526d
SHA512 4b9642606b9cbbca593112707b9779251c87315e006b1c20aa90a3ec927ab7929ba0bf0d37cedc10ddadf035732711fc2508d66fb8f5baddf3df4c142500e0bb
SSDEEP 1536:hbSYv9ZK5QPqfhVWbdsmA+RjPFLC+e5hy0ZGUGf2g:hGYvHNPqfcxA+HFshyOg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1220-10-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/2576-11-0x0000000000400000-0x0000000000419000-memory.dmp

Download