10ba2fbc2780246ea343c0753ecad041624aace953c81f55509661bc6ed8eb42

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 09:10

Target

95b91dad0e5bdb404102f6755bbe4900_NeikiAnalytics.exe
Size

265KB
MD5

95b91dad0e5bdb404102f6755bbe4900
SHA1

02f3917efecc429e49c95de415487e4bd1e43f63
SHA256

10ba2fbc2780246ea343c0753ecad041624aace953c81f55509661bc6ed8eb42
SHA512

5f56ae795c73f71ebcb676512105547858a31f57ee7845a24362a0d399b106a3590a5d52304bf5ca03cd6088b22e081811d2f84a495be7337bfa0b5d9e70ecb6
SSDEEP

3072:+ROP62+ssE7UoOdd9PNtJodkPHQo8qU5J62+ssE7UoOdd9PN:8kZ+z2fOdd9PNodkfJUTZ+z2fOdd9PN

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1184	1632	95b91dad0e5bdb404102f6755bbe4900_NeikiAnalytics.exe	28
PID 1632 wrote to memory of 1184	1632	95b91dad0e5bdb404102f6755bbe4900_NeikiAnalytics.exe	28
PID 1632 wrote to memory of 1184	1632	95b91dad0e5bdb404102f6755bbe4900_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\95b91dad0e5bdb404102f6755bbe4900_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\95b91dad0e5bdb404102f6755bbe4900_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 376
  2⤵
  PID:1184

memory/1184-3-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/1632-0-0x000007FEF5F7E000-0x000007FEF5F7F000-memory.dmp

Filesize
4KB

Download
memory/1632-1-0x000007FEF5CC0000-0x000007FEF665D000-memory.dmp

Filesize
9.6MB

Download
memory/1632-2-0x000007FEF5CC0000-0x000007FEF665D000-memory.dmp

Filesize
9.6MB

Download
memory/1632-4-0x000007FEF5CC0000-0x000007FEF665D000-memory.dmp

Filesize
9.6MB

Download
memory/1632-5-0x000007FEF5F7E000-0x000007FEF5F7F000-memory.dmp

Filesize
4KB

Download