273ace0ae390bb7b8e6fe9a70b5b4337a407aa68c928418d32a1aff6338b95cf | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 20:56

Sharing

Report Analysis Logs

General

Target

0e24d6ccfab718357ff1464f2bedc450_NeikiAnalytics.exe
Size

1.1MB
MD5

0e24d6ccfab718357ff1464f2bedc450
SHA1

b1f38e7e6cdf316903e913c857782cebf42bc0db
SHA256

273ace0ae390bb7b8e6fe9a70b5b4337a407aa68c928418d32a1aff6338b95cf
SHA512

483c6b777a4c0b16261a967dd5432ecae35cdc64f2f132c2a8be5e0b0f252d89939c5580c82f29674c2b9d31f422d18f59f4541d7291a7d5ff62dd9214381e9d
SSDEEP

24576:uDVoaRXLGcF0IBKiL1KSaf4QncbqviNH:aaaNf1KSajv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0e24d6ccfab718357ff1464f2bedc450_NeikiAnalytics.exe

description	pid	process	target process
PID 3028 wrote to memory of 2144	3028	0e24d6ccfab718357ff1464f2bedc450_NeikiAnalytics.exe	splwow64.exe
PID 3028 wrote to memory of 2144	3028	0e24d6ccfab718357ff1464f2bedc450_NeikiAnalytics.exe	splwow64.exe
PID 3028 wrote to memory of 2144	3028	0e24d6ccfab718357ff1464f2bedc450_NeikiAnalytics.exe	splwow64.exe
PID 3028 wrote to memory of 2144	3028	0e24d6ccfab718357ff1464f2bedc450_NeikiAnalytics.exe	splwow64.exe

C:\Users\Admin\AppData\Local\Temp\0e24d6ccfab718357ff1464f2bedc450_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0e24d6ccfab718357ff1464f2bedc450_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:2144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3028-0-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/3028-1-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3028-4-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download