067ef8512f58f01b76149fcca4a4f627a50e139072ba02a4b6f627dfe817d369

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 21:37

Target

067ef8512f58f01b76149fcca4a4f627a50e139072ba02a4b6f627dfe817d369_NeikiAnalytics.exe
Size

10KB
MD5

813aa2e14cb01a58fd06a0bd2008f8f0
SHA1

8a7107956f424931cf2e5d419d44ff25f9a2e21d
SHA256

067ef8512f58f01b76149fcca4a4f627a50e139072ba02a4b6f627dfe817d369
SHA512

7c7efb45a466b2dbbc732f93b37b5aa0590f64b01ca2281839e7ffb767cbb9ab29c73a1ed0ec9d0692a8de18c8e25df3664df3749fb39d5a4bd4124166ed2a7b
SSDEEP

192:G4BbXKl+Oq/ELAFaSmt6jsxXz+DuJtg3c1WgV6YbWS8hWu:BAl+N8ksxs4xXzXJScZV6YbWS8hW

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
280	msinfo32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2964	067ef8512f58f01b76149fcca4a4f627a50e139072ba02a4b6f627dfe817d369_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 280	2964	067ef8512f58f01b76149fcca4a4f627a50e139072ba02a4b6f627dfe817d369_NeikiAnalytics.exe	28
PID 2964 wrote to memory of 280	2964	067ef8512f58f01b76149fcca4a4f627a50e139072ba02a4b6f627dfe817d369_NeikiAnalytics.exe	28
PID 2964 wrote to memory of 280	2964	067ef8512f58f01b76149fcca4a4f627a50e139072ba02a4b6f627dfe817d369_NeikiAnalytics.exe	28
PID 2964 wrote to memory of 280	2964	067ef8512f58f01b76149fcca4a4f627a50e139072ba02a4b6f627dfe817d369_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\067ef8512f58f01b76149fcca4a4f627a50e139072ba02a4b6f627dfe817d369_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\067ef8512f58f01b76149fcca4a4f627a50e139072ba02a4b6f627dfe817d369_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\msinfo32.exe
  mmc.exe
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:280