70066067815bd3701b1ecd0ef6f03956e5294356037f8c5db3ab4a6e148130e5

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 03:57

Target

8c92777301c0ba5ffdafdffc2c015d80_NeikiAnalytics.exe
Size

79KB
MD5

8c92777301c0ba5ffdafdffc2c015d80
SHA1

4c2394223bc93c99d4814f119986e5318cc5646a
SHA256

70066067815bd3701b1ecd0ef6f03956e5294356037f8c5db3ab4a6e148130e5
SHA512

f3a0d4bd335baad58bfef82496d58b17dab48785b8abe3b077cd294d5d8e532d226a53c1a58486fd5ec8fea5e275badabecdb7ba57ebe5ee8acb627c49d9c990
SSDEEP

1536:zvKxifeJrDfME+2+OQA8AkqUhMb2nuy5wgIP0CSJ+5y4B8GMGlZ5G:zvGifgMSGdqU7uy5w9WMy4N5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2220	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2132	cmd.exe
2132	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2132	2288	8c92777301c0ba5ffdafdffc2c015d80_NeikiAnalytics.exe	29
PID 2288 wrote to memory of 2132	2288	8c92777301c0ba5ffdafdffc2c015d80_NeikiAnalytics.exe	29
PID 2288 wrote to memory of 2132	2288	8c92777301c0ba5ffdafdffc2c015d80_NeikiAnalytics.exe	29
PID 2288 wrote to memory of 2132	2288	8c92777301c0ba5ffdafdffc2c015d80_NeikiAnalytics.exe	29
PID 2132 wrote to memory of 2220	2132	cmd.exe	30
PID 2132 wrote to memory of 2220	2132	cmd.exe	30
PID 2132 wrote to memory of 2220	2132	cmd.exe	30
PID 2132 wrote to memory of 2220	2132	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\8c92777301c0ba5ffdafdffc2c015d80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8c92777301c0ba5ffdafdffc2c015d80_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2220

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
2deba48035cd412fb65cb8b3b517d174

SHA1
1ca3b0f9f24de0e0ff4e1334aa19ed9eed126b88

SHA256
c08751b8d72eea738ef26827b812e8a7b359dea8fb5afb9e081b93b9e27fd7ef

SHA512
cbc558dbf9c2c317083ba09ec278ca822d3f2a07a85f225defd5fdc22a613acab0c8fea13e2b5bc689834fb33a96aa091063473a37048fc3ff4991e4dd24eafa

Download Submit
memory/2220-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2288-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download