304da66bdb5881793a5a87edd834e5dfcd807deaa894ac8f2cae35333f101fe8

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 22:34

Target

304da66bdb5881793a5a87edd834e5dfcd807deaa894ac8f2cae35333f101fe8_NeikiAnalytics.exe
Size

73KB
MD5

876ba76ce5052d1576df51ff786afbb0
SHA1

96b6d1a919831d80632457ec2413fc973364e449
SHA256

304da66bdb5881793a5a87edd834e5dfcd807deaa894ac8f2cae35333f101fe8
SHA512

d0af9ed83b48fae4e70537d03aad2dca7fc78c452dd94c944f90abbb5ec234fb39c41553c1d0f4b2b8b4e6a1672dba4da6a82b35616399b680d3ff240b3a2f28
SSDEEP

1536:hbpCUCU608K5QPqfhVWbdsmA+RjPFLC+e5hX0ZGUGf2g:hlCUCX08NPqfcxA+HFshXOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2096	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2784	cmd.exe
2784	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2784	2908	304da66bdb5881793a5a87edd834e5dfcd807deaa894ac8f2cae35333f101fe8_NeikiAnalytics.exe	29
PID 2908 wrote to memory of 2784	2908	304da66bdb5881793a5a87edd834e5dfcd807deaa894ac8f2cae35333f101fe8_NeikiAnalytics.exe	29
PID 2908 wrote to memory of 2784	2908	304da66bdb5881793a5a87edd834e5dfcd807deaa894ac8f2cae35333f101fe8_NeikiAnalytics.exe	29
PID 2908 wrote to memory of 2784	2908	304da66bdb5881793a5a87edd834e5dfcd807deaa894ac8f2cae35333f101fe8_NeikiAnalytics.exe	29
PID 2784 wrote to memory of 2096	2784	cmd.exe	30
PID 2784 wrote to memory of 2096	2784	cmd.exe	30
PID 2784 wrote to memory of 2096	2784	cmd.exe	30
PID 2784 wrote to memory of 2096	2784	cmd.exe	30
PID 2096 wrote to memory of 2480	2096	[email protected]	31
PID 2096 wrote to memory of 2480	2096	[email protected]	31
PID 2096 wrote to memory of 2480	2096	[email protected]	31
PID 2096 wrote to memory of 2480	2096	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\304da66bdb5881793a5a87edd834e5dfcd807deaa894ac8f2cae35333f101fe8_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\304da66bdb5881793a5a87edd834e5dfcd807deaa894ac8f2cae35333f101fe8_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2096
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2480

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
688acb4f7732078d92585d48719cf569

SHA1
174ce9e22f17f28db675cba5ed39099a0eb6fe52

SHA256
2a937a8d2e157924cb5cd08c2ed157cb5ff182e6abe60be5f6af5a59a52bbfb1

SHA512
cf71d7b3b6436a44e32c5c56802088aae32cf4f10c2ca4b74384b0d4c75db17badacdc805016edc9f0af1253e5008ba81b0447d5fd2283960bf82f1d82a6e56e

Download Submit
memory/2096-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2908-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download