7de7b6493945cd6794f47a60b637a56727581526e627cce54e7419c193ead406

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 04:49

Target

77dcd127415ee5cc720438c1a44ebe50_NeikiAnalytics.exe
Size

79KB
MD5

77dcd127415ee5cc720438c1a44ebe50
SHA1

e4375f0f074abee65ff68ed7f906fb7381cf86ec
SHA256

7de7b6493945cd6794f47a60b637a56727581526e627cce54e7419c193ead406
SHA512

eabbc1d69e22a423619dd168213ce4efebf56380547d8e55866babce7b126157441304dc1807aecde3b3e94954873f60a6989dfd4025bacbda1758534adfa36d
SSDEEP

1536:zvxVDuD1AYrOQA8AkqUhMb2nuy5wgIP0CSJ+5y3B8GMGlZ5G:zvPqT6GdqU7uy5w9WMy3N5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3020	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
1980	cmd.exe
1980	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 1980	2740	77dcd127415ee5cc720438c1a44ebe50_NeikiAnalytics.exe	29
PID 2740 wrote to memory of 1980	2740	77dcd127415ee5cc720438c1a44ebe50_NeikiAnalytics.exe	29
PID 2740 wrote to memory of 1980	2740	77dcd127415ee5cc720438c1a44ebe50_NeikiAnalytics.exe	29
PID 2740 wrote to memory of 1980	2740	77dcd127415ee5cc720438c1a44ebe50_NeikiAnalytics.exe	29
PID 1980 wrote to memory of 3020	1980	cmd.exe	30
PID 1980 wrote to memory of 3020	1980	cmd.exe	30
PID 1980 wrote to memory of 3020	1980	cmd.exe	30
PID 1980 wrote to memory of 3020	1980	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\77dcd127415ee5cc720438c1a44ebe50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\77dcd127415ee5cc720438c1a44ebe50_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:3020

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
e1827e92c850d7138027a9d49bf71add

SHA1
bf46da5c549604d67da96edc019494d133797d17

SHA256
0058256fa12baded3992008749ac3be6c21c227f50564d03bb2c725921885cd5

SHA512
8fa170b84c384281b4f186b18b0e7347d215e458ba9a81cad550a9701827827832cc40e94c55238b77951451079b80f90a208ce29ef90a766bef20bfaf4cc800

Download Submit
memory/2740-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3020-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download