fccf10c3b4671184c36224f87b0d4fc6ae8b74207792c7345824b7fb9566f9ce

Analysis

max time kernel
140s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 19:03

Target

442465a7953fc18e3facf6fba1bd6510_NeikiAnalytics.exe
Size

1.8MB
MD5

442465a7953fc18e3facf6fba1bd6510
SHA1

5da1e873434074062f46ba72d67fcc1f058cc99d
SHA256

fccf10c3b4671184c36224f87b0d4fc6ae8b74207792c7345824b7fb9566f9ce
SHA512

33b5c8ebf5d6ce028c0f1d99016ad076872b8b6d5e5281f36b8b7a0c3e7afcd23c3c739c2504b202288a96aade65be3d8ddd07b26dbc0e06dbd0a3c5394c9808
SSDEEP

24576:G6VIFDHMwSyXWoFx0mHOlEoj7QA8JsU3Aot+Ec0xMkwd0MzWsRbF:7VIFDHMwDWoFxAljQMd0MzWsRbF

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 1420	2372	442465a7953fc18e3facf6fba1bd6510_NeikiAnalytics.exe	83
PID 2372 wrote to memory of 1420	2372	442465a7953fc18e3facf6fba1bd6510_NeikiAnalytics.exe	83

C:\Users\Admin\AppData\Local\Temp\442465a7953fc18e3facf6fba1bd6510_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\442465a7953fc18e3facf6fba1bd6510_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1420

memory/2372-0-0x0000000000400000-0x00000000004FF000-memory.dmp

Filesize
1020KB

Download