0d81610273bf86a553c475660cc3e091c92de87f0f3d00a8ac046e8eb2204f17

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 23:34

Target

0d81610273bf86a553c475660cc3e091c92de87f0f3d00a8ac046e8eb2204f17_NeikiAnalytics.exe
Size

66KB
MD5

70614727b708b0fb1600cea9e9c82180
SHA1

e9a9a8f2a9103f25ac1bbf92d1549f10b6e3f986
SHA256

0d81610273bf86a553c475660cc3e091c92de87f0f3d00a8ac046e8eb2204f17
SHA512

cfada771036d7cae22397c78a21a5c8a1e05b51ba7cfe1ada7625d01b53d7b7fff501f34245b4b26b759b99db27dc54ecb96b487d0235b8b6fcb7dd6ff39600c
SSDEEP

768:iLxqBt1sJw5pVNUP1/kvtbWcpmCKXfak3QIXjLZJ2bXfqQKMq+gjTAfu/MB8QKpH:1teqYQIXJJyXEv/MBK6vRel1Gwl

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
2216	irpoxoadú±¬±
2388	irpoxoadú±¬±

Loads dropped DLL 3 IoCs

pid	Process
2420	0d81610273bf86a553c475660cc3e091c92de87f0f3d00a8ac046e8eb2204f17_NeikiAnalytics.exe
2420	0d81610273bf86a553c475660cc3e091c92de87f0f3d00a8ac046e8eb2204f17_NeikiAnalytics.exe
2216	irpoxoadú±¬±

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\irpoxoadú±¬±	0d81610273bf86a553c475660cc3e091c92de87f0f3d00a8ac046e8eb2204f17_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\usnoapifú°¸¸	irpoxoadú±¬±
File created	C:\Windows\SysWOW64\usnoapifú°¸¸	irpoxoadú±¬±
File opened for modification	C:\Windows\SysWOW64\irpoxoadú±¬±	irpoxoadú±¬±
File opened for modification	C:\Windows\SysWOW64\irpoxoadú±¬±	0d81610273bf86a553c475660cc3e091c92de87f0f3d00a8ac046e8eb2204f17_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2216	2420	0d81610273bf86a553c475660cc3e091c92de87f0f3d00a8ac046e8eb2204f17_NeikiAnalytics.exe	28
PID 2420 wrote to memory of 2216	2420	0d81610273bf86a553c475660cc3e091c92de87f0f3d00a8ac046e8eb2204f17_NeikiAnalytics.exe	28
PID 2420 wrote to memory of 2216	2420	0d81610273bf86a553c475660cc3e091c92de87f0f3d00a8ac046e8eb2204f17_NeikiAnalytics.exe	28
PID 2420 wrote to memory of 2216	2420	0d81610273bf86a553c475660cc3e091c92de87f0f3d00a8ac046e8eb2204f17_NeikiAnalytics.exe	28
PID 2216 wrote to memory of 2388	2216	irpoxoadú±¬±	29
PID 2216 wrote to memory of 2388	2216	irpoxoadú±¬±	29
PID 2216 wrote to memory of 2388	2216	irpoxoadú±¬±	29
PID 2216 wrote to memory of 2388	2216	irpoxoadú±¬±	29

C:\Windows\SysWOW64\usnoapifú°¸¸

Filesize
5KB

MD5
48c45e05569f9a5665d082fbdc116c14

SHA1
e491ab1327b88312fc6d0535621b6de733c8efb5

SHA256
7e916f847bb5de3e09b36bd527e09ed656df13296bdcd9924185bcccde7dbe4c

SHA512
e1cc47e185831dc6c40372efc227f299964f262c641b790d31f0fe452a5bc70a4946c689913504c64790833c131d40c01fcd9ff3a148636be9f502959f7cc49c

Download Submit
\Windows\SysWOW64\irpoxoadú±¬±

Filesize
66KB

MD5
70614727b708b0fb1600cea9e9c82180

SHA1
e9a9a8f2a9103f25ac1bbf92d1549f10b6e3f986

SHA256
0d81610273bf86a553c475660cc3e091c92de87f0f3d00a8ac046e8eb2204f17

SHA512
cfada771036d7cae22397c78a21a5c8a1e05b51ba7cfe1ada7625d01b53d7b7fff501f34245b4b26b759b99db27dc54ecb96b487d0235b8b6fcb7dd6ff39600c

Download Submit
memory/2216-28-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2388-29-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2420-9-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download