9586c2f13d707c91eba85a2002151944b9a9e33a7333717a8939c6f4fa55de02

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 20:37

Target

097c2e7bb97270fd510b48f5dd0f3740_NeikiAnalytics.exe
Size

377KB
MD5

097c2e7bb97270fd510b48f5dd0f3740
SHA1

b8a1a320fbf866044c7d8c06bf5bd64b8b816b93
SHA256

9586c2f13d707c91eba85a2002151944b9a9e33a7333717a8939c6f4fa55de02
SHA512

3ad5da60d432397515cc48131efbed5864ad4130ff78571bcc86d05f3f6118edc23047d464158f83fc364cd56c18a143b3e1195476e629234a7497ea9b8801dc
SSDEEP

6144:443aJ9uRGEIrSa2tOwH0H+wtVCfWdNUz8Sn8wPaFdNIs7NVJXHJip8ib:13aJMFIwwA/zp8HdGsjF

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2172	2580	097c2e7bb97270fd510b48f5dd0f3740_NeikiAnalytics.exe	28
PID 2580 wrote to memory of 2172	2580	097c2e7bb97270fd510b48f5dd0f3740_NeikiAnalytics.exe	28
PID 2580 wrote to memory of 2172	2580	097c2e7bb97270fd510b48f5dd0f3740_NeikiAnalytics.exe	28
PID 2580 wrote to memory of 2172	2580	097c2e7bb97270fd510b48f5dd0f3740_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\097c2e7bb97270fd510b48f5dd0f3740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\097c2e7bb97270fd510b48f5dd0f3740_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 408
  2⤵
  PID:2172

memory/2172-3-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2580-0-0x0000000074F31000-0x0000000074F32000-memory.dmp

Filesize
4KB

Download
memory/2580-1-0x0000000074F30000-0x00000000754DB000-memory.dmp

Filesize
5.7MB

Download
memory/2580-2-0x0000000074F30000-0x00000000754DB000-memory.dmp

Filesize
5.7MB

Download
memory/2580-4-0x0000000074F30000-0x00000000754DB000-memory.dmp

Filesize
5.7MB

Download