00046f5896b5c20b9e357359b03e379e93ced460aed9ebe5f6b49faa0b0c65dc

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 01:51

Target

9754167ab12afd90090c321831ce8680_NeikiAnalytics.exe
Size

73KB
MD5

9754167ab12afd90090c321831ce8680
SHA1

d66975066fd8c0c2e69b1d6b57051a360e58df25
SHA256

00046f5896b5c20b9e357359b03e379e93ced460aed9ebe5f6b49faa0b0c65dc
SHA512

b6a46fd7a1514c820fd65dadf5c576b92b1243fbdfb67838b4ebac357f800c2911ec730948ebeac7f66afb90a75671d5283dbe1e01dd0180df77d0a57d6503a4
SSDEEP

1536:hbpe+jSbp8k0zvrWK5QPqfhVWbdsmA+RjPFLC+e5hJ0ZGUGf2g:hTjIEnWNPqfcxA+HFshJOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2900	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2096	cmd.exe
2096	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2096	2860	9754167ab12afd90090c321831ce8680_NeikiAnalytics.exe	29
PID 2860 wrote to memory of 2096	2860	9754167ab12afd90090c321831ce8680_NeikiAnalytics.exe	29
PID 2860 wrote to memory of 2096	2860	9754167ab12afd90090c321831ce8680_NeikiAnalytics.exe	29
PID 2860 wrote to memory of 2096	2860	9754167ab12afd90090c321831ce8680_NeikiAnalytics.exe	29
PID 2096 wrote to memory of 2900	2096	cmd.exe	30
PID 2096 wrote to memory of 2900	2096	cmd.exe	30
PID 2096 wrote to memory of 2900	2096	cmd.exe	30
PID 2096 wrote to memory of 2900	2096	cmd.exe	30
PID 2900 wrote to memory of 2944	2900	[email protected]	31
PID 2900 wrote to memory of 2944	2900	[email protected]	31
PID 2900 wrote to memory of 2944	2900	[email protected]	31
PID 2900 wrote to memory of 2944	2900	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\9754167ab12afd90090c321831ce8680_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9754167ab12afd90090c321831ce8680_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 462116.exe
      4⤵
      PID:2944

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
0f091ed8dd3891e4c5c6a0d00484bb4f

SHA1
5ddf2634f505c7a9dc9d1e50ca469a689f333ff4

SHA256
280e5cda95dcb46e39cbdc2352ef6f8f4342ee47a3a84fee3347938c60a75bfb

SHA512
b30ed0992c42ca9dda13a7d703463cab6ebde9e5497c2c89c995e63ad04fc9f98917a596d39ac3b658222940a54d4caac86eda4ac725a9b0dd401bd17ac57308

Download Submit
memory/2860-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2900-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download