5ed930c38a8b8062dfb1253413b2bee1441fb1a0df2d46e64b2a9421283b3706

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:18

Target

60585a75708331f196063a31587a8fd0_NeikiAnalytics.exe
Size

7KB
MD5

60585a75708331f196063a31587a8fd0
SHA1

6a3cc7a29ebcac5ed938fdc2d99168d3121a47af
SHA256

5ed930c38a8b8062dfb1253413b2bee1441fb1a0df2d46e64b2a9421283b3706
SHA512

24613f5505ab8d271ae2f8dd40b272e8a1d7ff8ce027b945c07e58fbb078ba73c54079bc2ac65b5efbcba0404df623cb0bf7d210d77bf47b1a6e7ccd5b61dad5
SSDEEP

96:MZoTYYc+fIwmH7cOW5iIZBd2+RPgfrBpMD8w3TvEzNt:MZoTYBN7IEIZX2yPUMgIG

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

60585a75708331f196063a31587a8fd0_NeikiAnalytics.exe

description	pid	process	target process
PID 2224 wrote to memory of 1168	2224	60585a75708331f196063a31587a8fd0_NeikiAnalytics.exe	dw20.exe
PID 2224 wrote to memory of 1168	2224	60585a75708331f196063a31587a8fd0_NeikiAnalytics.exe	dw20.exe
PID 2224 wrote to memory of 1168	2224	60585a75708331f196063a31587a8fd0_NeikiAnalytics.exe	dw20.exe
PID 2224 wrote to memory of 1168	2224	60585a75708331f196063a31587a8fd0_NeikiAnalytics.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\60585a75708331f196063a31587a8fd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\60585a75708331f196063a31587a8fd0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 404
2⤵
PID:1168

memory/1168-3-0x0000000000780000-0x0000000000781000-memory.dmp

Filesize
4KB

Download
memory/2224-0-0x0000000074801000-0x0000000074802000-memory.dmp

Filesize
4KB

Download
memory/2224-1-0x0000000074800000-0x0000000074DAB000-memory.dmp

Filesize
5.7MB

Download
memory/2224-2-0x0000000074800000-0x0000000074DAB000-memory.dmp

Filesize
5.7MB

Download
memory/2224-4-0x0000000074800000-0x0000000074DAB000-memory.dmp

Filesize
5.7MB

Download