9c9f0bbec5c6b1dd9b28f0e00cbcd67b7f8e57a58d97a9b25d04c1727fab884e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 23:35

Target

107c98ada529ee0c382bd3c495eadfa0_NeikiAnalytics.exe
Size

666KB
MD5

107c98ada529ee0c382bd3c495eadfa0
SHA1

0233adf488247eb6cc7382ff14a3e6cce0dd61d1
SHA256

9c9f0bbec5c6b1dd9b28f0e00cbcd67b7f8e57a58d97a9b25d04c1727fab884e
SHA512

3ca68fbc4bfcd91a38766f37c58388e2b972a89a9c1193d3741194c919dd850aee6be5c69a32463f091919faa219f3e3a89c524a8806fe33379b4d470457de37
SSDEEP

6144:lCppEzHOatJMceIlWv9nfZj9j7zocKVSTFP5VSG3E/TikX:l40JMfIlInP5VSt

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

107c98ada529ee0c382bd3c495eadfa0_NeikiAnalytics.exe

description	pid	process	target process
PID 2464 wrote to memory of 1320	2464	107c98ada529ee0c382bd3c495eadfa0_NeikiAnalytics.exe	dw20.exe
PID 2464 wrote to memory of 1320	2464	107c98ada529ee0c382bd3c495eadfa0_NeikiAnalytics.exe	dw20.exe
PID 2464 wrote to memory of 1320	2464	107c98ada529ee0c382bd3c495eadfa0_NeikiAnalytics.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\107c98ada529ee0c382bd3c495eadfa0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\107c98ada529ee0c382bd3c495eadfa0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2464

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 404
2⤵
PID:1320

memory/1320-3-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/2464-0-0x000007FEF5B9E000-0x000007FEF5B9F000-memory.dmp

Filesize
4KB

Download
memory/2464-1-0x000007FEF58E0000-0x000007FEF627D000-memory.dmp

Filesize
9.6MB

Download
memory/2464-2-0x000007FEF58E0000-0x000007FEF627D000-memory.dmp

Filesize
9.6MB

Download
memory/2464-4-0x000007FEF58E0000-0x000007FEF627D000-memory.dmp

Filesize
9.6MB

Download
memory/2464-5-0x000007FEF5B9E000-0x000007FEF5B9F000-memory.dmp

Filesize
4KB

Download