4dbcabc6049ff6a7ba5486b6d37976b13f47b0f1440f5bc8a3aa8f5496673ee4

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:10

Target

7514f9cbe5f9fe21a3cfb9e46a107340_NeikiAnalytics.exe
Size

64KB
MD5

7514f9cbe5f9fe21a3cfb9e46a107340
SHA1

3322979a76b67428bc5887f395f2115992747da7
SHA256

4dbcabc6049ff6a7ba5486b6d37976b13f47b0f1440f5bc8a3aa8f5496673ee4
SHA512

dccca9c79384fa45cd353283088ead0a75e3550b054014310936630517c699bf6f7d97059633b9572f91acdeede3aadf50918ca9378c70d2a4e4ad51836aa831
SSDEEP

768:Bt6DBdGcB5XjekqX+L/YznXMfr2GUsMez7l+YF9f3YQHBIoDuNJ9UamtI58LP+K3:B6pe8YznXDsx40R3YQK4uL9UHCe13

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

7514f9cbe5f9fe21a3cfb9e46a107340_NeikiAnalytics.exe

description	pid	process	target process
PID 1680 wrote to memory of 1884	1680	7514f9cbe5f9fe21a3cfb9e46a107340_NeikiAnalytics.exe	dw20.exe
PID 1680 wrote to memory of 1884	1680	7514f9cbe5f9fe21a3cfb9e46a107340_NeikiAnalytics.exe	dw20.exe
PID 1680 wrote to memory of 1884	1680	7514f9cbe5f9fe21a3cfb9e46a107340_NeikiAnalytics.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\7514f9cbe5f9fe21a3cfb9e46a107340_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7514f9cbe5f9fe21a3cfb9e46a107340_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 428
2⤵
PID:1884

memory/1680-0-0x000007FEF5D4E000-0x000007FEF5D4F000-memory.dmp

Filesize
4KB

Download
memory/1680-1-0x000007FEF5A90000-0x000007FEF642D000-memory.dmp

Filesize
9.6MB

Download
memory/1680-2-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/1680-3-0x000007FEF5A90000-0x000007FEF642D000-memory.dmp

Filesize
9.6MB

Download
memory/1680-4-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/1680-6-0x000007FEF5A90000-0x000007FEF642D000-memory.dmp

Filesize
9.6MB

Download
memory/1680-7-0x000007FEF5D4E000-0x000007FEF5D4F000-memory.dmp

Filesize
4KB

Download
memory/1884-5-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

Filesize
4KB

Download