fbae8ebbbe2c364486e0d4dd632a77019ffa880fffa304dbd0e5d48b33ff5be5

Analysis

max time kernel
140s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 14:31

Target

5e9d0af95bd46226ee5fd95c2dae22d0_NeikiAnalytics.exe
Size

653KB
MD5

5e9d0af95bd46226ee5fd95c2dae22d0
SHA1

2f2c9eb2bfda5796266c6586a5384c0dbf532e73
SHA256

fbae8ebbbe2c364486e0d4dd632a77019ffa880fffa304dbd0e5d48b33ff5be5
SHA512

8c88f90e39c8f24cddd8fbe31a738c84fa6697b1593acb05699a0d7cf6faf66e0fbf61c477ace88b7a345acd2a8b909e33e077b713ac2b62d4b7c93dd0727bd0
SSDEEP

12288:Q3ggq6MaimNk28Rz17yJRJLyt2BDyE7TNW9yyfA5KW7/il+MRjWAehRk+E:j7vmp8Rz1GJR8AB+Is9yvr7/jk9

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1816-0-0x000000013F650000-0x000000013FA72000-memory.dmp	upx
behavioral1/memory/1816-2-0x000000013F650000-0x000000013FA72000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 1964	1816	5e9d0af95bd46226ee5fd95c2dae22d0_NeikiAnalytics.exe	29
PID 1816 wrote to memory of 1964	1816	5e9d0af95bd46226ee5fd95c2dae22d0_NeikiAnalytics.exe	29
PID 1816 wrote to memory of 1964	1816	5e9d0af95bd46226ee5fd95c2dae22d0_NeikiAnalytics.exe	29

C:\Users\Admin\AppData\Local\Temp\5e9d0af95bd46226ee5fd95c2dae22d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5e9d0af95bd46226ee5fd95c2dae22d0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1816 -s 84
  2⤵
  PID:1964

memory/1816-0-0x000000013F650000-0x000000013FA72000-memory.dmp

Filesize
4.1MB

Download
memory/1816-1-0x00000000000F0000-0x0000000000110000-memory.dmp

Filesize
128KB

Download
memory/1816-2-0x000000013F650000-0x000000013FA72000-memory.dmp

Filesize
4.1MB

Download