60d9fb3cce93ce02ef2dd59b4ab872a787a7bd4255311f440296da32c7a3ab52

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 03:46

Target

9a672b3f38f39125df4315f758161b90_NeikiAnalytics.exe
Size

79KB
MD5

9a672b3f38f39125df4315f758161b90
SHA1

f784fe1ea733bfbf59d8472d68a6587cf69f4175
SHA256

60d9fb3cce93ce02ef2dd59b4ab872a787a7bd4255311f440296da32c7a3ab52
SHA512

a455378d1a6bb1e600ed6d086db155463f21c250484232f08007024b9bdfcf8e67a4159a6949c223c25cdb479c809a38f467b49bfdbea71e74ed4f4226ed5277
SSDEEP

1536:zvO/iWQN7sVqtRZuuOQA8AkqUhMb2nuy5wgIP0CSJ+5y5B8GMGlZ5G:zvO6LP7Z+GdqU7uy5w9WMy5N5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2796	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
1624	cmd.exe
1624	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 1624	2872	9a672b3f38f39125df4315f758161b90_NeikiAnalytics.exe	29
PID 2872 wrote to memory of 1624	2872	9a672b3f38f39125df4315f758161b90_NeikiAnalytics.exe	29
PID 2872 wrote to memory of 1624	2872	9a672b3f38f39125df4315f758161b90_NeikiAnalytics.exe	29
PID 2872 wrote to memory of 1624	2872	9a672b3f38f39125df4315f758161b90_NeikiAnalytics.exe	29
PID 1624 wrote to memory of 2796	1624	cmd.exe	30
PID 1624 wrote to memory of 2796	1624	cmd.exe	30
PID 1624 wrote to memory of 2796	1624	cmd.exe	30
PID 1624 wrote to memory of 2796	1624	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\9a672b3f38f39125df4315f758161b90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9a672b3f38f39125df4315f758161b90_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2796

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
e1343d71c55e6b2fe56db6ef549d5de3

SHA1
cce68a342140bef98b7954019420625fa2c51d5b

SHA256
a48adb6f1e037e25435e13e3df7028244c6b798094d3519ad2a5984445cfbf82

SHA512
f7f7567ebc68d23e709084c2abbdc2a645d0c35a14b2709e531c6f503260423b5c898160a541c28fc0ab3ce428f0fbc09b5bb53117a26ccbc8521013fdfef0b2

Download Submit
memory/2796-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2872-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download