63614148f6599f0799c8879693701398f1ffa3ca1a455a75ae5bff6204fedb53

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 03:32

Target

75513e9e9e167ba106de50b1f911ff50_NeikiAnalytics.exe
Size

73KB
MD5

75513e9e9e167ba106de50b1f911ff50
SHA1

8f9b44ab3bde90188d6de69f1bb0877f33c558b5
SHA256

63614148f6599f0799c8879693701398f1ffa3ca1a455a75ae5bff6204fedb53
SHA512

cf0f1b0d7dbe48d900bb7e4c36c510e7a92e8d0d33c02fbd6c1dc21887acfdaf2879a9aa2b940a043fe3a0fc09b644047b668546fd4c604ff44b4152d8e92067
SSDEEP

1536:hb6CZbDT3dl2ZrcnK5QPqfhVWbdsmA+RjPFLC+e5hM0ZGUGf2g:h3T3dl2BoNPqfcxA+HFshMOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3040	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
3028	cmd.exe
3028	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 3028	2616	75513e9e9e167ba106de50b1f911ff50_NeikiAnalytics.exe	29
PID 2616 wrote to memory of 3028	2616	75513e9e9e167ba106de50b1f911ff50_NeikiAnalytics.exe	29
PID 2616 wrote to memory of 3028	2616	75513e9e9e167ba106de50b1f911ff50_NeikiAnalytics.exe	29
PID 2616 wrote to memory of 3028	2616	75513e9e9e167ba106de50b1f911ff50_NeikiAnalytics.exe	29
PID 3028 wrote to memory of 3040	3028	cmd.exe	30
PID 3028 wrote to memory of 3040	3028	cmd.exe	30
PID 3028 wrote to memory of 3040	3028	cmd.exe	30
PID 3028 wrote to memory of 3040	3028	cmd.exe	30
PID 3040 wrote to memory of 2704	3040	[email protected]	31
PID 3040 wrote to memory of 2704	3040	[email protected]	31
PID 3040 wrote to memory of 2704	3040	[email protected]	31
PID 3040 wrote to memory of 2704	3040	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\75513e9e9e167ba106de50b1f911ff50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\75513e9e9e167ba106de50b1f911ff50_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2704

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
42c9d8b2cee524751b5ddfdfb80cdeae

SHA1
7dc8c5bb0561277c65d7dc8be37e945b9582a616

SHA256
80ff9a3882122d14662a23d83909b70776b06935618c05812ce421a26b30dac0

SHA512
bb407c643dc24182b8a190ec711802349154bdeebc3d4d7c1955de5e9ccbaeff55d9f755862bd595cd015bb26c237e4eece3b1113c8c2ae6e17c968c53020ce1

Download Submit
memory/2616-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3040-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download