a445b26bb36fc163f59bc556495c9420a7d5a708f2c554d47a7278b95be83c61

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 10:43

Target
a08505ad145653aa39dffd8b532f37b0_NeikiAnalytics.exe
Size 73KB
Sample240603-msqffada52
SHA256 a445b26bb36fc163f59bc556495c9420a7d5a708f2c554d47a7278b95be83c61
MD5 a08505ad145653aa39dffd8b532f37b0
SHA1 7098269bce07641247fcb71371d5b7ae2467465a
SHA512 cc5e3ab3f709413ba4850b42b8a3ba0ad8346c1a37948b08092b8bf3867b4a22cef8c9bdf9428987e0e42a3b17548ba6548ee35447e86fba0a3d03d77c0bc448
SSDEEP 1536:hbZgPaa0RNK5QPqfhVWbdsmA+RjPFLC+e5h20ZGUGf2g:hNgeRNNPqfcxA+HFsh2Og
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1288	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
1272	cmd.exe
1272	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1272	1612	a08505ad145653aa39dffd8b532f37b0_NeikiAnalytics.exe	29
PID 1612 wrote to memory of 1272	1612	a08505ad145653aa39dffd8b532f37b0_NeikiAnalytics.exe	29
PID 1612 wrote to memory of 1272	1612	a08505ad145653aa39dffd8b532f37b0_NeikiAnalytics.exe	29
PID 1612 wrote to memory of 1272	1612	a08505ad145653aa39dffd8b532f37b0_NeikiAnalytics.exe	29
PID 1272 wrote to memory of 1288	1272	cmd.exe	30
PID 1272 wrote to memory of 1288	1272	cmd.exe	30
PID 1272 wrote to memory of 1288	1272	cmd.exe	30
PID 1272 wrote to memory of 1288	1272	cmd.exe	30
PID 1288 wrote to memory of 1680	1288	[email protected]	31
PID 1288 wrote to memory of 1680	1288	[email protected]	31
PID 1288 wrote to memory of 1680	1288	[email protected]	31
PID 1288 wrote to memory of 1680	1288	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\a08505ad145653aa39dffd8b532f37b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a08505ad145653aa39dffd8b532f37b0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:1680

Path \Users\Admin\AppData\Local\Temp\[email protected]
Size 73KB
SHA256 df7c7ddc84ddd6f96b63d200ca4a762d551620ca35d83b38b64d9bd6334d50d1
MD5 14b00fe71895dce1e317f50b7fa3c43c
SHA1 9453da5448fe3c0f891f5921b53c4ac381852526
SHA512 406dc7ae20b6af54c89150409db3b8bd7e674a9d5b3e2357a5699da155dfa8eae01a9f849e736936a2d7a4e8b95628e9de68beedd3d93010ccf8584e1dde5621
SSDEEP 1536:hbSYv9ZK5QPqfhVWbdsmA+RjPFLC+e5hG0ZGUGf2g:hGYvHNPqfcxA+HFshGOg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1288-10-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/1612-11-0x0000000000400000-0x0000000000419000-memory.dmp

Download