c6025c73756d6e37c9977fe7ec647864871c37b928d82bddd08ec773a5b59217

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 07:22

Target

50a72b61d3012702e4c453a8b5f08390_NeikiAnalytics.exe
Size

73KB
MD5

50a72b61d3012702e4c453a8b5f08390
SHA1

5c4b285b8cfdab4df5afdb25942ad1e1ad752a51
SHA256

c6025c73756d6e37c9977fe7ec647864871c37b928d82bddd08ec773a5b59217
SHA512

8933ceb6955632be1ab42ccbfe389f0bfa8fc74c96cbb1b685dc66d8de8e72b61a21708e1ea47ca34be861cc569f19625a6e7bec3e23aff498b3f87442018553
SSDEEP

1536:hbSYv9ZK5QPqfhVWbdsmA+RjPFLC+e5hj0ZGUGf2g:hGYvHNPqfcxA+HFshjOg

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2980	2924	50a72b61d3012702e4c453a8b5f08390_NeikiAnalytics.exe	29
PID 2924 wrote to memory of 2980	2924	50a72b61d3012702e4c453a8b5f08390_NeikiAnalytics.exe	29
PID 2924 wrote to memory of 2980	2924	50a72b61d3012702e4c453a8b5f08390_NeikiAnalytics.exe	29
PID 2924 wrote to memory of 2980	2924	50a72b61d3012702e4c453a8b5f08390_NeikiAnalytics.exe	29

C:\Users\Admin\AppData\Local\Temp\50a72b61d3012702e4c453a8b5f08390_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\50a72b61d3012702e4c453a8b5f08390_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 00.exe
  2⤵
  PID:2980

memory/2924-5-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download