0cef2638966b2544eb3930312dfe327ddc4e853beba1e286a6c0ce2653a38eb8

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 21:42

Target

0cef2638966b2544eb3930312dfe327ddc4e853beba1e286a6c0ce2653a38eb8_NeikiAnalytics.exe
Size

79KB
MD5

57fcd8a529f06d901a9202002a7a3910
SHA1

ddf3df718d3cdfb9fec1d80bc1d729494ef0124a
SHA256

0cef2638966b2544eb3930312dfe327ddc4e853beba1e286a6c0ce2653a38eb8
SHA512

78c6df31eebd7f3452af64a9d3ac1270cc2bdcef25c09dcd87e85ecb16bf12444c778579f78e03c52e579c20dec7656e219a0a01c8ed31bb37f224ea52cdb64a
SSDEEP

1536:zvqrRgojWFT+eDOQA8AkqUhMb2nuy5wgIP0CSJ+5ymB8GMGlZ5G:zvCRkFT3iGdqU7uy5w9WMymN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2980	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
1672	cmd.exe
1672	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1672	1684	0cef2638966b2544eb3930312dfe327ddc4e853beba1e286a6c0ce2653a38eb8_NeikiAnalytics.exe	29
PID 1684 wrote to memory of 1672	1684	0cef2638966b2544eb3930312dfe327ddc4e853beba1e286a6c0ce2653a38eb8_NeikiAnalytics.exe	29
PID 1684 wrote to memory of 1672	1684	0cef2638966b2544eb3930312dfe327ddc4e853beba1e286a6c0ce2653a38eb8_NeikiAnalytics.exe	29
PID 1684 wrote to memory of 1672	1684	0cef2638966b2544eb3930312dfe327ddc4e853beba1e286a6c0ce2653a38eb8_NeikiAnalytics.exe	29
PID 1672 wrote to memory of 2980	1672	cmd.exe	30
PID 1672 wrote to memory of 2980	1672	cmd.exe	30
PID 1672 wrote to memory of 2980	1672	cmd.exe	30
PID 1672 wrote to memory of 2980	1672	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\0cef2638966b2544eb3930312dfe327ddc4e853beba1e286a6c0ce2653a38eb8_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0cef2638966b2544eb3930312dfe327ddc4e853beba1e286a6c0ce2653a38eb8_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2980

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
2443cffea369e7f5b2068568620b2a0c

SHA1
d416da43def2fc74065df98f463cc6750c6378af

SHA256
b398b9a5bb2ab6210018d78a2cbddecd19aca31425e10f555dba38b8e6002c3a

SHA512
5b43185e23c43f5e1e06318c87918b10f1269a591fe05f80701823c4f180dcb29bc793d6380d4980d740884fb2c8d239e09f7a0df62da14c7389ec4855c8ed5f

Download Submit
memory/1684-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2980-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download