c7cdd5fbf603dd073c20caeb4549bfb2f46d25b5a09eb7a6bdca3a8a796aacc7

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 11:00

Target

a108cefc19829d1b63ce8c6c4d2e7560_NeikiAnalytics.exe
Size

73KB
MD5

a108cefc19829d1b63ce8c6c4d2e7560
SHA1

27b509efae72e7f353cd1b1cf79b5ac95c1b4e6c
SHA256

c7cdd5fbf603dd073c20caeb4549bfb2f46d25b5a09eb7a6bdca3a8a796aacc7
SHA512

2b876676f27d7b8d5cefc66059684d8e050c058b36b05f95c6c7f59324b2a1fff7d8afa318a1c79e8b9e3c3b956a067abc08a9b273b990a4c77192c137517f40
SSDEEP

1536:hbH1xeUhdK5QPqfhVWbdsmA+RjPFLC+e5hC0ZGUGf2g:hreUhdNPqfcxA+HFshCOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2256	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2272	cmd.exe
2272	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 2272	1804	a108cefc19829d1b63ce8c6c4d2e7560_NeikiAnalytics.exe	29
PID 1804 wrote to memory of 2272	1804	a108cefc19829d1b63ce8c6c4d2e7560_NeikiAnalytics.exe	29
PID 1804 wrote to memory of 2272	1804	a108cefc19829d1b63ce8c6c4d2e7560_NeikiAnalytics.exe	29
PID 1804 wrote to memory of 2272	1804	a108cefc19829d1b63ce8c6c4d2e7560_NeikiAnalytics.exe	29
PID 2272 wrote to memory of 2256	2272	cmd.exe	30
PID 2272 wrote to memory of 2256	2272	cmd.exe	30
PID 2272 wrote to memory of 2256	2272	cmd.exe	30
PID 2272 wrote to memory of 2256	2272	cmd.exe	30
PID 2256 wrote to memory of 3048	2256	[email protected]	31
PID 2256 wrote to memory of 3048	2256	[email protected]	31
PID 2256 wrote to memory of 3048	2256	[email protected]	31
PID 2256 wrote to memory of 3048	2256	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\a108cefc19829d1b63ce8c6c4d2e7560_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a108cefc19829d1b63ce8c6c4d2e7560_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2256
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:3048

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
314b03470e612fc8256111cd39d4fd3b

SHA1
61293fd6594e28abdaf53a1195be23d159bc76ea

SHA256
807bffe1b0c552fe34a7a34fdc53ee51d1b8ae73f424c834c969448e7adfac18

SHA512
8c03a3484003200c2a3543fcfb83c8962160d1c8792d31234cbde9f251f08ef217295099134b2a66842ad618b6cbdd4c1d03166e1ba6709d724bce2fbc1312c9

Download Submit
memory/1804-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2256-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download