ce766d4455dc1508aa4b42557c6df124983a889bad224febab086de312271080

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 13:07

Target
a46a5e1dc3ee850f594398b729898dd0_NeikiAnalytics.exe
Size 79KB
Sample240603-qcsgmsfd7x
SHA256 ce766d4455dc1508aa4b42557c6df124983a889bad224febab086de312271080
MD5 a46a5e1dc3ee850f594398b729898dd0
SHA1 0fa0376fc2708873eb5d030f88febdd05338ace5
SHA512 ecb5181eaf3544619321319549f118eff6136310f721a9217480008199fa7fc58a499b9cbc0ed0c66f6ef952a83f594e74768506c974228918d6220630cabefe
SSDEEP 1536:zvm5Om0rld8Ms1FAOgSmOQA8AkqUhMb2nuy5wgIP0CSJ+5yIB8GMGlZ5G:zvm5OTld8r1QSjGdqU7uy5w9WMyIN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2740	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2592	cmd.exe
2592	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2592	2264	a46a5e1dc3ee850f594398b729898dd0_NeikiAnalytics.exe	29
PID 2264 wrote to memory of 2592	2264	a46a5e1dc3ee850f594398b729898dd0_NeikiAnalytics.exe	29
PID 2264 wrote to memory of 2592	2264	a46a5e1dc3ee850f594398b729898dd0_NeikiAnalytics.exe	29
PID 2264 wrote to memory of 2592	2264	a46a5e1dc3ee850f594398b729898dd0_NeikiAnalytics.exe	29
PID 2592 wrote to memory of 2740	2592	cmd.exe	30
PID 2592 wrote to memory of 2740	2592	cmd.exe	30
PID 2592 wrote to memory of 2740	2592	cmd.exe	30
PID 2592 wrote to memory of 2740	2592	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\a46a5e1dc3ee850f594398b729898dd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a46a5e1dc3ee850f594398b729898dd0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2740

Path \Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 e9b8e49b4a686ae5b6ecf8372d14fe13358ca420119c8be553b1b173a321c84e
MD5 a5800c4a188287b9665234e553a89099
SHA1 19f34c19d71dec2dbb9be299e78f37ef962f7ca4
SHA512 0e8108a3869b3b2a1c3af5195bdbaf66a1c0782e58afede8e52a0a57b78ff286b701bd9c9bcbbb81a00f15b8ee156556056a873cdd25b35d27a372975176c636
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5ySB8GMGlZ5G:zv+vTpGdqU7uy5w9WMySN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2264-8-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2740-7-0x0000000000400000-0x000000000041B000-memory.dmp

Download