6d98fb3bddbdae100cc6b4e4e465f6f6bd4d9b03a8d154ffecfffae7dd355fc2

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 21:36

Target

568165ddfd0467ba2951bd78a203b600_NeikiAnalytics.exe
Size

79KB
MD5

568165ddfd0467ba2951bd78a203b600
SHA1

cc85a38edc3cd487c2488dc64012aa38a7f1e8d4
SHA256

6d98fb3bddbdae100cc6b4e4e465f6f6bd4d9b03a8d154ffecfffae7dd355fc2
SHA512

6de5f905c388a84728f4c5d7c51281078b0874c33521ed6156355ee81169610945a7b0f15eae9e1af80aa7134f84e8106025a48dfc34ffc74bbdea5c2eef2f57
SSDEEP

1536:zvO/iWQN7sVqtRZuuOQA8AkqUhMb2nuy5wgIP0CSJ+5yzB8GMGlZ5G:zvO6LP7Z+GdqU7uy5w9WMyzN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2180	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2036	cmd.exe
2036	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2036	1708	568165ddfd0467ba2951bd78a203b600_NeikiAnalytics.exe	29
PID 1708 wrote to memory of 2036	1708	568165ddfd0467ba2951bd78a203b600_NeikiAnalytics.exe	29
PID 1708 wrote to memory of 2036	1708	568165ddfd0467ba2951bd78a203b600_NeikiAnalytics.exe	29
PID 1708 wrote to memory of 2036	1708	568165ddfd0467ba2951bd78a203b600_NeikiAnalytics.exe	29
PID 2036 wrote to memory of 2180	2036	cmd.exe	30
PID 2036 wrote to memory of 2180	2036	cmd.exe	30
PID 2036 wrote to memory of 2180	2036	cmd.exe	30
PID 2036 wrote to memory of 2180	2036	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\568165ddfd0467ba2951bd78a203b600_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\568165ddfd0467ba2951bd78a203b600_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:2180

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
a6353fb847b55dd5afe9da9cc9368e8d

SHA1
52a458131b8b89231f5749585d0dd4bb82d82fa5

SHA256
a3d9e66ad70d7f138711f8662299298795003f5772f09be80c451185ec2f6d16

SHA512
daa5ab672a69b391d4151409e68a7abea2861f5b8c9b15030ac2d20fcc1d5a98f1d8ff4aaf6a9e30dfac8f4cf8d9103fe6670abf4c3c39abc82bcbfd13506743

Download Submit
memory/1708-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2180-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download