94cb05a894b5ee2c7957662274e0d5c106315c850b88c52b898c5514c732912d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 05:06

Target

8e8d0b1dbed41986b5e699b447167560_NeikiAnalytics.exe
Size

79KB
MD5

8e8d0b1dbed41986b5e699b447167560
SHA1

233ef81417894037ed000fc255ec8b334cded1cc
SHA256

94cb05a894b5ee2c7957662274e0d5c106315c850b88c52b898c5514c732912d
SHA512

9462b74ea343daa4f8b589299bfd291f15ef5497b2734092af84ea984959fcc2610eceed34878df3f56fdada2f6225815a212bde9846437d2aa495bc95c97d68
SSDEEP

1536:zvf6IcE+NURbOQA8AkqUhMb2nuy5wgIP0CSJ+5yTB8GMGlZ5G:zvEE+NmKGdqU7uy5w9WMyTN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2976	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2160	cmd.exe
2160	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 348 wrote to memory of 2160	348	8e8d0b1dbed41986b5e699b447167560_NeikiAnalytics.exe	29
PID 348 wrote to memory of 2160	348	8e8d0b1dbed41986b5e699b447167560_NeikiAnalytics.exe	29
PID 348 wrote to memory of 2160	348	8e8d0b1dbed41986b5e699b447167560_NeikiAnalytics.exe	29
PID 348 wrote to memory of 2160	348	8e8d0b1dbed41986b5e699b447167560_NeikiAnalytics.exe	29
PID 2160 wrote to memory of 2976	2160	cmd.exe	30
PID 2160 wrote to memory of 2976	2160	cmd.exe	30
PID 2160 wrote to memory of 2976	2160	cmd.exe	30
PID 2160 wrote to memory of 2976	2160	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\8e8d0b1dbed41986b5e699b447167560_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8e8d0b1dbed41986b5e699b447167560_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2976

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
08b7d7e137d3d058ce8a8cc5249d5abb

SHA1
53f73ce0f5781f14a525066a9f5b00b52eb97ee0

SHA256
36d23b50e1d9dad34fc9213a3211181ba052907ed737b1b30da3ea3f736d1efc

SHA512
56c156c491a829b2bdfe38f98089fe36cf84457712a7c423e0d8dc7e6e4e004804a5d381a0042aa45649c8cab09ceab23a5b0928bdc957604d40fa52b30283fa

Download Submit
memory/348-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2976-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download