1852df0b5c23bb365579863cebeabc7e10f4294d9066c7f6480248c6b54d1e78

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 13:02

Target

d3364a660fb523189a393209409667e0_NeikiAnalytics.exe
Size

22KB
MD5

d3364a660fb523189a393209409667e0
SHA1

b8bdb2ba826b10ad5194e53fabc9743686b6def0
SHA256

1852df0b5c23bb365579863cebeabc7e10f4294d9066c7f6480248c6b54d1e78
SHA512

f17f6037160b92ff0e678f5812897268d36013ac316bfedcd83a1e82de52e4864c3ea6ef1ca9e1baa2fe760a3f5ed613e75b46f5e3429cf28c3d632ba2b6ef29
SSDEEP

384:+/MFNU/dOLx9RR31n3L/45aQfdp8S1XH/:+/MFNUsvRh1nb6VH/

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2608	1688	d3364a660fb523189a393209409667e0_NeikiAnalytics.exe	28
PID 1688 wrote to memory of 2608	1688	d3364a660fb523189a393209409667e0_NeikiAnalytics.exe	28
PID 1688 wrote to memory of 2608	1688	d3364a660fb523189a393209409667e0_NeikiAnalytics.exe	28
PID 1688 wrote to memory of 2608	1688	d3364a660fb523189a393209409667e0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\d3364a660fb523189a393209409667e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d3364a660fb523189a393209409667e0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 432
  2⤵
  PID:2608

memory/1688-0-0x0000000074481000-0x0000000074482000-memory.dmp

Filesize
4KB

Download
memory/1688-2-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download
memory/1688-1-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download
memory/1688-4-0x0000000074480000-0x0000000074A2B000-memory.dmp

Filesize
5.7MB

Download
memory/2608-3-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/2608-5-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download