fcdd56154346965a9a6d0836abbf213ab4244fbddbf1c971b6ec20c66d50e6f3

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 11:31

Target

3c6ee56f0a1163bbb86464064d0ddaa0_NeikiAnalytics.exe
Size

79KB
MD5

3c6ee56f0a1163bbb86464064d0ddaa0
SHA1

94502c2e4ddb7854352edf129d3e728d1f8edb5d
SHA256

fcdd56154346965a9a6d0836abbf213ab4244fbddbf1c971b6ec20c66d50e6f3
SHA512

7af20d542bcd837ea16507d08cb4aa420440f4981a2607698a2757bbf582ec0128dd368795b2e9dc721e9646e7fc461d954f41798231d98420236aaa7739e9db
SSDEEP

1536:zvUuCr1fx7hoOQA8AkqUhMb2nuy5wgIP0CSJ+5yQB8GMGlZ5G:zvMBx7rGdqU7uy5w9WMyQN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2596	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
1276	cmd.exe
1276	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1276	2168	3c6ee56f0a1163bbb86464064d0ddaa0_NeikiAnalytics.exe	29
PID 2168 wrote to memory of 1276	2168	3c6ee56f0a1163bbb86464064d0ddaa0_NeikiAnalytics.exe	29
PID 2168 wrote to memory of 1276	2168	3c6ee56f0a1163bbb86464064d0ddaa0_NeikiAnalytics.exe	29
PID 2168 wrote to memory of 1276	2168	3c6ee56f0a1163bbb86464064d0ddaa0_NeikiAnalytics.exe	29
PID 1276 wrote to memory of 2596	1276	cmd.exe	30
PID 1276 wrote to memory of 2596	1276	cmd.exe	30
PID 1276 wrote to memory of 2596	1276	cmd.exe	30
PID 1276 wrote to memory of 2596	1276	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\3c6ee56f0a1163bbb86464064d0ddaa0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3c6ee56f0a1163bbb86464064d0ddaa0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2596

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
c8014cf74df01f679d5b4a8401f04675

SHA1
46eb2f1fe58821dd1cd1a587b460af897352ff8a

SHA256
b2e2247b8bdb1c6d02be43c724f543a835e73666fec5d504a1edb8c16e4a41ae

SHA512
2b3102c281b02a3fc63ba5fcaa7c30a3b66fa983207eb855018609aafbedbd440ca6177dea798b0e9f1ad82403115d5a6e24b21b57c8e685c7e7af305067ffc1

Download Submit
memory/2168-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2596-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download