1c41be0b3b0d7da9a5999ce7a44b38b56555f925a57b6e51863449d6c4811114

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 01:04

Target

2202a88b615a992a2fd969aa9fedbe10_NeikiAnalytics.exe
Size

30KB
MD5

2202a88b615a992a2fd969aa9fedbe10
SHA1

1ed5a26625db1ac7d771ff9c106be9f727b1b9f0
SHA256

1c41be0b3b0d7da9a5999ce7a44b38b56555f925a57b6e51863449d6c4811114
SHA512

9f2f1a3eb7faa1dd0add011df843c6f0df0312b3ef3218ef51cbca210d462c25924ddc9d6093c2034551527a9f4a3cb21c4b611d436233218bbc4d0a0b6ad9fc
SSDEEP

384:IVwHu3N+CVF/MAg6KK2I+26sOORnMUlNDNbMqsG1P99qit0NWO9E7A:6N5Mgp+2fOOpMgD2eP992WQEs

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2972	dw20.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2972	2176	2202a88b615a992a2fd969aa9fedbe10_NeikiAnalytics.exe	29
PID 2176 wrote to memory of 2972	2176	2202a88b615a992a2fd969aa9fedbe10_NeikiAnalytics.exe	29
PID 2176 wrote to memory of 2972	2176	2202a88b615a992a2fd969aa9fedbe10_NeikiAnalytics.exe	29

C:\Users\Admin\AppData\Local\Temp\2202a88b615a992a2fd969aa9fedbe10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2202a88b615a992a2fd969aa9fedbe10_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 372
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2972

memory/2176-0-0x000007FEF5BEE000-0x000007FEF5BEF000-memory.dmp

Filesize
4KB

Download
memory/2176-1-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/2176-3-0x000007FEF5930000-0x000007FEF62CD000-memory.dmp

Filesize
9.6MB

Download
memory/2972-2-0x0000000000470000-0x0000000000471000-memory.dmp

Filesize
4KB

Download
memory/2972-4-0x0000000000470000-0x0000000000471000-memory.dmp

Filesize
4KB

Download