74f7d78429b1bca9516da39343118b371d14e6fdb25b8708ff3d32391c84ab8c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 16:57

Target

748f98d4289c294ee45a7b8a6c9aa9c0NeikiAnalytics.exe
Size

7.4MB
MD5

748f98d4289c294ee45a7b8a6c9aa9c0
SHA1

255b8f45a7e994abc1cb3fa97f7d09041888011c
SHA256

74f7d78429b1bca9516da39343118b371d14e6fdb25b8708ff3d32391c84ab8c
SHA512

a4a838f2cedaeb17d61bae3808adc20a8fbaeec48d8a423240c3eb18509f73782822ed499642840a64212196c1f15af7101975c9362576ff9ef257a1095825aa
SSDEEP

196608:SrH5P9VjurErvI9pWjgfPvzm6gsFEB4Auq:YlNurEUWjC3zDb84Auq

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

748f98d4289c294ee45a7b8a6c9aa9c0NeikiAnalytics.exe

pid process

2600 748f98d4289c294ee45a7b8a6c9aa9c0NeikiAnalytics.exe
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\_MEI12602\python311.dll upx

pid	process
2600	748f98d4289c294ee45a7b8a6c9aa9c0NeikiAnalytics.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI12602\python311.dll	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

748f98d4289c294ee45a7b8a6c9aa9c0NeikiAnalytics.exe

description	pid	process	target process
PID 1260 wrote to memory of 2600	1260	748f98d4289c294ee45a7b8a6c9aa9c0NeikiAnalytics.exe	748f98d4289c294ee45a7b8a6c9aa9c0NeikiAnalytics.exe
PID 1260 wrote to memory of 2600	1260	748f98d4289c294ee45a7b8a6c9aa9c0NeikiAnalytics.exe	748f98d4289c294ee45a7b8a6c9aa9c0NeikiAnalytics.exe
PID 1260 wrote to memory of 2600	1260	748f98d4289c294ee45a7b8a6c9aa9c0NeikiAnalytics.exe	748f98d4289c294ee45a7b8a6c9aa9c0NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\748f98d4289c294ee45a7b8a6c9aa9c0NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\748f98d4289c294ee45a7b8a6c9aa9c0NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1260

C:\Users\Admin\AppData\Local\Temp\748f98d4289c294ee45a7b8a6c9aa9c0NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\748f98d4289c294ee45a7b8a6c9aa9c0NeikiAnalytics.exe"
2⤵
- Loads dropped DLL
PID:2600

C:\Users\Admin\AppData\Local\Temp\_MEI12602\python311.dll
Filesize
1.6MB

MD5
ccdbd8027f165575a66245f8e9d140de

SHA1
d91786422ce1f1ad35c528d1c4cd28b753a81550

SHA256
503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

SHA512
870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

Download Submit
memory/2600-24-0x000007FEF5C50000-0x000007FEF6242000-memory.dmp

Filesize
5.9MB

Download