b8f19bf55d05d263e328d82827180802cbea7b1fa7e189a23066f48c9731fd19

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 07:15

Target

7c6411fc70617c5fb7e820ce38321970_NeikiAnalytics.exe
Size

79KB
MD5

7c6411fc70617c5fb7e820ce38321970
SHA1

709b47410337f0c5d046d37fcbc7f80a194c2df1
SHA256

b8f19bf55d05d263e328d82827180802cbea7b1fa7e189a23066f48c9731fd19
SHA512

75c48ca3b5dfe124ade84e6dbf424ed72ed2214ba7e91983df9381958183fe57085438ed45243cc4ca3d5bd67d0b17757a89cd70389f7b4bb1277634f84ef634
SSDEEP

1536:zvI+hUIvhCXa+buOQA8AkqUhMb2nuy5wgIP0CSJ+5yfB8GMGlZ5G:zvIMUV77GdqU7uy5w9WMyfN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1760	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2416	cmd.exe
2416	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2416	1724	7c6411fc70617c5fb7e820ce38321970_NeikiAnalytics.exe	29
PID 1724 wrote to memory of 2416	1724	7c6411fc70617c5fb7e820ce38321970_NeikiAnalytics.exe	29
PID 1724 wrote to memory of 2416	1724	7c6411fc70617c5fb7e820ce38321970_NeikiAnalytics.exe	29
PID 1724 wrote to memory of 2416	1724	7c6411fc70617c5fb7e820ce38321970_NeikiAnalytics.exe	29
PID 2416 wrote to memory of 1760	2416	cmd.exe	30
PID 2416 wrote to memory of 1760	2416	cmd.exe	30
PID 2416 wrote to memory of 1760	2416	cmd.exe	30
PID 2416 wrote to memory of 1760	2416	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\7c6411fc70617c5fb7e820ce38321970_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7c6411fc70617c5fb7e820ce38321970_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:1760

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
f04d7fcb9d0a062221b3a30300fe3229

SHA1
cd80358fe26d0b8c5667837a23180ed60857e5c2

SHA256
9b98b24ebe41d314631168309dd29d24d8b7f8be949508dfdddfda26ade50800

SHA512
ba091fa47ac19bd34258ebec4020d26ac1f5796a1e0ea5fde8422cd824c0cc18bafb0a69a7d1bcb3a42d05866a88baaa3c92c8127dc54119441739a8855106d0

Download Submit
memory/1724-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1760-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download