c00e590037dbdfe3c7c9999e63235d54fde7dc3342b86ffd59008b1e4abb4b4d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 00:15

Target

2390fa515f4eff3ef485f5d5d8e02d90_NeikiAnalytics.exe
Size

79KB
MD5

2390fa515f4eff3ef485f5d5d8e02d90
SHA1

e5e08f587280ef0a910a3c063c5f2ff3ff1e4137
SHA256

c00e590037dbdfe3c7c9999e63235d54fde7dc3342b86ffd59008b1e4abb4b4d
SHA512

30294c3de06bcb482386938464b6d5cabdd86afce6869374d1ef1f0e4bbb755ad08a6af71534189780dc9b901be1c157685e51c4683badc2946f354d07f492a5
SSDEEP

1536:zv6fdjP2uMHZAOQA8AkqUhMb2nuy5wgIP0CSJ+5y0ZB8GMGlZ5G:zv652PjGdqU7uy5w9WMy0ZN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2632	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
1708	cmd.exe
1708	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 1708	2872	2390fa515f4eff3ef485f5d5d8e02d90_NeikiAnalytics.exe	29
PID 2872 wrote to memory of 1708	2872	2390fa515f4eff3ef485f5d5d8e02d90_NeikiAnalytics.exe	29
PID 2872 wrote to memory of 1708	2872	2390fa515f4eff3ef485f5d5d8e02d90_NeikiAnalytics.exe	29
PID 2872 wrote to memory of 1708	2872	2390fa515f4eff3ef485f5d5d8e02d90_NeikiAnalytics.exe	29
PID 1708 wrote to memory of 2632	1708	cmd.exe	30
PID 1708 wrote to memory of 2632	1708	cmd.exe	30
PID 1708 wrote to memory of 2632	1708	cmd.exe	30
PID 1708 wrote to memory of 2632	1708	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\2390fa515f4eff3ef485f5d5d8e02d90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2390fa515f4eff3ef485f5d5d8e02d90_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2632

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
3dbe2a3aabfe1fa0e8f5a1d63391f7ee

SHA1
99b8e180d95d72320f55cb076b77ba3674e56252

SHA256
662cf04219d3ef300ee11aca7b3cf1cceb6431413535b1768253f52b6253f0fc

SHA512
fd460453677d3f76657435c3420fc6380228d235ec3dbb1c7c9191447890657cb5fb3e6672b284f036cf8d66d7047040933387174e7c105dfaaf8c0cd8c26939

Download Submit
memory/2632-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2872-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download