9f046f1bb8ae96aa7f170f0534f62bf3a1a4c73f6cf928f5a282a74477bbb5e2

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 10:57

Target

cc18dd95772ccb39e3df231fa4b63860_NeikiAnalytics.exe
Size

1.4MB
MD5

cc18dd95772ccb39e3df231fa4b63860
SHA1

a642a2e29c7ea4a79247e8aa7e59b467c6c743dc
SHA256

9f046f1bb8ae96aa7f170f0534f62bf3a1a4c73f6cf928f5a282a74477bbb5e2
SHA512

cb5300061e2fe99b7d4000f3f12c6c184552bc34a993afb940ac5296ea15cfd750e3f14a1310d49873cb9a7b2b00864c2dfad797269b45fd01d1d654b809f2d7
SSDEEP

12288:4/PI49rNDS5lSAUtNL8YcL5YHaI7XHgZQKhJgeCmdC6IK4Uvy:4/DrNDS5lSXbL8iHFLHgZpJEH6N4P

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3004	dw20.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 3004	2128	cc18dd95772ccb39e3df231fa4b63860_NeikiAnalytics.exe	29
PID 2128 wrote to memory of 3004	2128	cc18dd95772ccb39e3df231fa4b63860_NeikiAnalytics.exe	29
PID 2128 wrote to memory of 3004	2128	cc18dd95772ccb39e3df231fa4b63860_NeikiAnalytics.exe	29
PID 2128 wrote to memory of 3004	2128	cc18dd95772ccb39e3df231fa4b63860_NeikiAnalytics.exe	29

C:\Users\Admin\AppData\Local\Temp\cc18dd95772ccb39e3df231fa4b63860_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\cc18dd95772ccb39e3df231fa4b63860_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 960
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3004

memory/2128-0-0x0000000074941000-0x0000000074942000-memory.dmp

Filesize
4KB

Download
memory/2128-1-0x0000000074940000-0x0000000074EEB000-memory.dmp

Filesize
5.7MB

Download
memory/2128-2-0x0000000074940000-0x0000000074EEB000-memory.dmp

Filesize
5.7MB

Download
memory/2128-13-0x0000000074940000-0x0000000074EEB000-memory.dmp

Filesize
5.7MB

Download
memory/3004-12-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download