92001a0e7abf0c9c1f5d8e1799efb059758953d39a30e7ffe1f97120821d60b8

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 09:54

Target

92001a0e7abf0c9c1f5d8e1799efb059758953d39a30e7ffe1f97120821d60b8_NeikiAnalytics.exe
Size

73KB
MD5

fc6b11592d0ae4bf6094a1e2a1635510
SHA1

3cc92f95f84b4cff6d5861455dbe2dfe6dad1b40
SHA256

92001a0e7abf0c9c1f5d8e1799efb059758953d39a30e7ffe1f97120821d60b8
SHA512

f8e70dd95e415a83c968a000ddc5dc3ebe1c16a78abfaaeabc9a7a3149e8f8d9991fd5a5ec75860021b15581d6200767ad9c08ca5dd2c035ce6c575042221ba6
SSDEEP

1536:hbrrboouBK5QPqfhVWbdsmA+RjPFLC+e5hSG0ZGUGf2g:hzENPqfcxA+HFshFOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1684	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
1848	cmd.exe
1848	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 1848	2408	92001a0e7abf0c9c1f5d8e1799efb059758953d39a30e7ffe1f97120821d60b8_NeikiAnalytics.exe	29
PID 2408 wrote to memory of 1848	2408	92001a0e7abf0c9c1f5d8e1799efb059758953d39a30e7ffe1f97120821d60b8_NeikiAnalytics.exe	29
PID 2408 wrote to memory of 1848	2408	92001a0e7abf0c9c1f5d8e1799efb059758953d39a30e7ffe1f97120821d60b8_NeikiAnalytics.exe	29
PID 2408 wrote to memory of 1848	2408	92001a0e7abf0c9c1f5d8e1799efb059758953d39a30e7ffe1f97120821d60b8_NeikiAnalytics.exe	29
PID 1848 wrote to memory of 1684	1848	cmd.exe	30
PID 1848 wrote to memory of 1684	1848	cmd.exe	30
PID 1848 wrote to memory of 1684	1848	cmd.exe	30
PID 1848 wrote to memory of 1684	1848	cmd.exe	30
PID 1684 wrote to memory of 2972	1684	[email protected]	31
PID 1684 wrote to memory of 2972	1684	[email protected]	31
PID 1684 wrote to memory of 2972	1684	[email protected]	31
PID 1684 wrote to memory of 2972	1684	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\92001a0e7abf0c9c1f5d8e1799efb059758953d39a30e7ffe1f97120821d60b8_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\92001a0e7abf0c9c1f5d8e1799efb059758953d39a30e7ffe1f97120821d60b8_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1684
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2972

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
8686ebbff3d5c5f66c71d4de29e9dc0c

SHA1
3f25151345ea60a7f5245942141e6ae024883128

SHA256
f2152f75667d6b3c3b36c5b175acbf8b7440564ad812484d67ec03cc8b8de0d6

SHA512
b8ac90a2402d9a8414e41619b17f58423c3192a013c5986e34ef6f6d5499897ad809945b1f5fa499813a1a4a3b3df0623e019a97e0bc3546b0b64bf47378679c

Download Submit
memory/1684-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2408-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download