444a40b750cc5d5bfbb9e7194e348c58db676d9d580f9fa9f30e3abace9a68ea

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 08:44

Target

444a40b750cc5d5bfbb9e7194e348c58db676d9d580f9fa9f30e3abace9a68ea_NeikiAnalytics.exe
Size

79KB
MD5

974569d6523199de2745b1a997e4e0e0
SHA1

0654594327b99c26dace2dc0974848ec4e00aa20
SHA256

444a40b750cc5d5bfbb9e7194e348c58db676d9d580f9fa9f30e3abace9a68ea
SHA512

74346cd18384d4a1601e289ea62c9c4204ae5da8a1c9eff7051eb1be7857ab63eb44edac80f55b7fcba7d4fcdf7feae76b527b341dfcc8f869a16ec00ef09c79
SSDEEP

1536:zvuE77Aou+e+OQA8AkqUhMb2nuy5wgIP0CSJ+5yBB8GMGlZ5G:zvuE7c+MGdqU7uy5w9WMyBN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2600	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
1756	cmd.exe
1756	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 1756	2992	444a40b750cc5d5bfbb9e7194e348c58db676d9d580f9fa9f30e3abace9a68ea_NeikiAnalytics.exe	29
PID 2992 wrote to memory of 1756	2992	444a40b750cc5d5bfbb9e7194e348c58db676d9d580f9fa9f30e3abace9a68ea_NeikiAnalytics.exe	29
PID 2992 wrote to memory of 1756	2992	444a40b750cc5d5bfbb9e7194e348c58db676d9d580f9fa9f30e3abace9a68ea_NeikiAnalytics.exe	29
PID 2992 wrote to memory of 1756	2992	444a40b750cc5d5bfbb9e7194e348c58db676d9d580f9fa9f30e3abace9a68ea_NeikiAnalytics.exe	29
PID 1756 wrote to memory of 2600	1756	cmd.exe	30
PID 1756 wrote to memory of 2600	1756	cmd.exe	30
PID 1756 wrote to memory of 2600	1756	cmd.exe	30
PID 1756 wrote to memory of 2600	1756	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\444a40b750cc5d5bfbb9e7194e348c58db676d9d580f9fa9f30e3abace9a68ea_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\444a40b750cc5d5bfbb9e7194e348c58db676d9d580f9fa9f30e3abace9a68ea_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2600

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
5eaff500475398514c0c2a92f8a511e0

SHA1
e9cf8d66ccb9253d1219b5eb339d158b2d9ea194

SHA256
32d94208144ff1b1a5422d7e68ae8371a5677ddd26e590df06610bad1d0279b8

SHA512
7e138caba4cca64f1688e5ae680383fb75dcc1263c674d210d201fd0be80c3b671f67390e58e0649998ddc2466f0dc7953a17bb26e21ed48bbcca8034e053493

Download Submit
memory/2600-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2992-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download