0d79b3dada74bab0134f04469f92cc750f916d9d5200bb7bb518133a2a54d23b

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 02:31

Target

8a1a515406545c253cd616598744bc60_NeikiAnalytics.exe
Size

79KB
MD5

8a1a515406545c253cd616598744bc60
SHA1

72b98b00112a696b750bf8c5826db0aec283abd5
SHA256

0d79b3dada74bab0134f04469f92cc750f916d9d5200bb7bb518133a2a54d23b
SHA512

3414a2cb18119773f208cc462747388070d531668992ec47f7ed0c7a1e4112c2ddeb9e88ed618ff6035fb16597cc6fae7a6ae355f6ec3e49cc947e69cd70bce2
SSDEEP

1536:zvLdkuNQXgNOqcQqfgOQA8AkqUhMb2nuy5wgIP0CSJ+5yBB8GMGlZ5G:zvJ16/Ia1GdqU7uy5w9WMyBN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2924	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2876	cmd.exe
2876	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2876	1848	8a1a515406545c253cd616598744bc60_NeikiAnalytics.exe	29
PID 1848 wrote to memory of 2876	1848	8a1a515406545c253cd616598744bc60_NeikiAnalytics.exe	29
PID 1848 wrote to memory of 2876	1848	8a1a515406545c253cd616598744bc60_NeikiAnalytics.exe	29
PID 1848 wrote to memory of 2876	1848	8a1a515406545c253cd616598744bc60_NeikiAnalytics.exe	29
PID 2876 wrote to memory of 2924	2876	cmd.exe	30
PID 2876 wrote to memory of 2924	2876	cmd.exe	30
PID 2876 wrote to memory of 2924	2876	cmd.exe	30
PID 2876 wrote to memory of 2924	2876	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\8a1a515406545c253cd616598744bc60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8a1a515406545c253cd616598744bc60_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2924

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
39ef33b2cad293e3f05f290a19b1ed7d

SHA1
48bca5f43f55a68c0bc832d1fb83b94abca98331

SHA256
1a7d62207e65f2935d2641b63424e4f718b4514af2d1106fc0cc0c0b9efb6224

SHA512
a0a4fd41ee739a440ba470c71a4c3ae2d775bea3983f71eb1fbd56fd6171a10be003f66279ab31ea1c6729483062a9259b5fc0f0029d3da1bd2018e22d916792

Download Submit
memory/1848-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2924-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download