0e96d72deaaa64d0bd8a55089fd6b81d518df5a54d512668dd663c872b0b78a0

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 13:46

Target

0e96d72deaaa64d0bd8a55089fd6b81d518df5a54d512668dd663c872b0b78a0_NeikiAnalytics.exe
Size

73KB
MD5

02c08d89af4648484ceef172af046f40
SHA1

90dfa313120d803e1d7070139812e22ab054d4ab
SHA256

0e96d72deaaa64d0bd8a55089fd6b81d518df5a54d512668dd663c872b0b78a0
SHA512

ca6afe12468033d2df81acffb90877c745396dc904f1ddf3719c3d285e7687d4958d9e12a2dbde2969aab893d31c1b7db66cfeaa212eb9004ee73c2230844ede
SSDEEP

1536:hbWXV21dWzmKK5QPqfhVWbdsmA+RjPFLC+e5hq0ZGUGf2g:h221eFNPqfcxA+HFshqOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2424	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2176	cmd.exe
2176	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2176	1716	0e96d72deaaa64d0bd8a55089fd6b81d518df5a54d512668dd663c872b0b78a0_NeikiAnalytics.exe	29
PID 1716 wrote to memory of 2176	1716	0e96d72deaaa64d0bd8a55089fd6b81d518df5a54d512668dd663c872b0b78a0_NeikiAnalytics.exe	29
PID 1716 wrote to memory of 2176	1716	0e96d72deaaa64d0bd8a55089fd6b81d518df5a54d512668dd663c872b0b78a0_NeikiAnalytics.exe	29
PID 1716 wrote to memory of 2176	1716	0e96d72deaaa64d0bd8a55089fd6b81d518df5a54d512668dd663c872b0b78a0_NeikiAnalytics.exe	29
PID 2176 wrote to memory of 2424	2176	cmd.exe	30
PID 2176 wrote to memory of 2424	2176	cmd.exe	30
PID 2176 wrote to memory of 2424	2176	cmd.exe	30
PID 2176 wrote to memory of 2424	2176	cmd.exe	30
PID 2424 wrote to memory of 2464	2424	[email protected]	31
PID 2424 wrote to memory of 2464	2424	[email protected]	31
PID 2424 wrote to memory of 2464	2424	[email protected]	31
PID 2424 wrote to memory of 2464	2424	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\0e96d72deaaa64d0bd8a55089fd6b81d518df5a54d512668dd663c872b0b78a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0e96d72deaaa64d0bd8a55089fd6b81d518df5a54d512668dd663c872b0b78a0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:2464

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
48b523b0e83de32fdb4ef6c75156ca7a

SHA1
6ba5c80278062470dc0b9049cbe6f83dbb2f6883

SHA256
30bc3cd322103f1d4060739e3e16b7409a6bd7245ae649b695d29a4560179531

SHA512
5b0d3361b54b3d8299aaa95e3fdb594d60e874099fdc36422a41545998586acd3839836b636ae433998642018d5c2bfc274f55abd569c149168a9915bfa11d2b

Download Submit
memory/1716-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2424-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download