7e47a92bdb0a34eeb680b318df8e8e98d4caf0472b0f930968151b23219bb9ad

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 20:48

Target

7f24b6367f8c18b9bea1daf5dfc6eb60_NeikiAnalytics.exe
Size

79KB
MD5

7f24b6367f8c18b9bea1daf5dfc6eb60
SHA1

996be1a299aa8bf534d2e8e5af5474fc78b96d65
SHA256

7e47a92bdb0a34eeb680b318df8e8e98d4caf0472b0f930968151b23219bb9ad
SHA512

686be886a81b89e0c9fcc9497ccca2416c7a0c05caa5c96966db92a1c6bdb35707744365573030e99efe1452ee6d21f2b89c8706f38963f12a04f1faeb797362
SSDEEP

1536:zvpySxR4aEN4w0CP3YwhOQA8AkqUhMb2nuy5wgIP0CSJ+5y8B8GMGlZ5G:zvzxcpWJGdqU7uy5w9WMy8N5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2932	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2504	cmd.exe
2504	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2504	2660	7f24b6367f8c18b9bea1daf5dfc6eb60_NeikiAnalytics.exe	29
PID 2660 wrote to memory of 2504	2660	7f24b6367f8c18b9bea1daf5dfc6eb60_NeikiAnalytics.exe	29
PID 2660 wrote to memory of 2504	2660	7f24b6367f8c18b9bea1daf5dfc6eb60_NeikiAnalytics.exe	29
PID 2660 wrote to memory of 2504	2660	7f24b6367f8c18b9bea1daf5dfc6eb60_NeikiAnalytics.exe	29
PID 2504 wrote to memory of 2932	2504	cmd.exe	30
PID 2504 wrote to memory of 2932	2504	cmd.exe	30
PID 2504 wrote to memory of 2932	2504	cmd.exe	30
PID 2504 wrote to memory of 2932	2504	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\7f24b6367f8c18b9bea1daf5dfc6eb60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7f24b6367f8c18b9bea1daf5dfc6eb60_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2932

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
315402485f961756c7c60a5d2b128c1c

SHA1
579f62b3702a249d21d3a35248367ea5cc06bcae

SHA256
7986d88f662072d33c878022ef4a99b2f25756bda6acdb37be7b21a0182e1b29

SHA512
6d4f8958253a400bab3b9eab7340952fd044f1f825aa40c62a07da6c3803eda22c5d7c2ca057b239643378ca3129ed437a2ee750420bb42544cf8a86b20a8111

Download Submit
memory/2660-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2932-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download