c33631a0ce4d928e828f49b63cf88d355e6a74db501fb5c157f9c4021e045d16

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 05:50

Target

8ad6be7ac88399c6478a943222cdfb00_NeikiAnalytics.exe
Size

1.7MB
MD5

8ad6be7ac88399c6478a943222cdfb00
SHA1

e19a795f00e2007ad1472e90ab9e31e6317d31bb
SHA256

c33631a0ce4d928e828f49b63cf88d355e6a74db501fb5c157f9c4021e045d16
SHA512

57d1852bcddf6d9b59915d0b622959ae4530e40e87662c37d6f4147eb2ed75a589f86282313691b0faf4abded4d76bcf72e9e7ce8dc1e3f2d4abeafe63174cbd
SSDEEP

49152:VniXrkgOxW69oddiiyiiyiiyii+iIimiiHy:BiXrNOxW69Siiyiiyiiyii+iIimiiHy

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2192	2424	8ad6be7ac88399c6478a943222cdfb00_NeikiAnalytics.exe	28
PID 2424 wrote to memory of 2192	2424	8ad6be7ac88399c6478a943222cdfb00_NeikiAnalytics.exe	28
PID 2424 wrote to memory of 2192	2424	8ad6be7ac88399c6478a943222cdfb00_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\8ad6be7ac88399c6478a943222cdfb00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8ad6be7ac88399c6478a943222cdfb00_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 376
  2⤵
  PID:2192

memory/2192-3-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/2424-0-0x000007FEF5B2E000-0x000007FEF5B2F000-memory.dmp

Filesize
4KB

Download
memory/2424-1-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/2424-2-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/2424-4-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/2424-5-0x000007FEF5B2E000-0x000007FEF5B2F000-memory.dmp

Filesize
4KB

Download