273ace0ae390bb7b8e6fe9a70b5b4337a407aa68c928418d32a1aff6338b95cf | Triage

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 20:56

Sharing

Report Analysis Logs

General

Target

0e24d6ccfab718357ff1464f2bedc450_NeikiAnalytics.exe
Size

1.1MB
MD5

0e24d6ccfab718357ff1464f2bedc450
SHA1

b1f38e7e6cdf316903e913c857782cebf42bc0db
SHA256

273ace0ae390bb7b8e6fe9a70b5b4337a407aa68c928418d32a1aff6338b95cf
SHA512

483c6b777a4c0b16261a967dd5432ecae35cdc64f2f132c2a8be5e0b0f252d89939c5580c82f29674c2b9d31f422d18f59f4541d7291a7d5ff62dd9214381e9d
SSDEEP

24576:uDVoaRXLGcF0IBKiL1KSaf4QncbqviNH:aaaNf1KSajv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

0e24d6ccfab718357ff1464f2bedc450_NeikiAnalytics.exe

description	pid	process	target process
PID 4964 wrote to memory of 2812	4964	0e24d6ccfab718357ff1464f2bedc450_NeikiAnalytics.exe	splwow64.exe
PID 4964 wrote to memory of 2812	4964	0e24d6ccfab718357ff1464f2bedc450_NeikiAnalytics.exe	splwow64.exe

C:\Users\Admin\AppData\Local\Temp\0e24d6ccfab718357ff1464f2bedc450_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0e24d6ccfab718357ff1464f2bedc450_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4964

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:2812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4964-0-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/4964-1-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/4964-2-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download