408aeba91ced88df032947c9ecb8d4819cff8948774329dab55c0508b40d7960

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 01:17

Target

397607cffa2e12539ffc34d169187f30_NeikiAnalytics.exe
Size

86KB
MD5

397607cffa2e12539ffc34d169187f30
SHA1

1634edf0b3a5b7c1798f802068d98b3743100510
SHA256

408aeba91ced88df032947c9ecb8d4819cff8948774329dab55c0508b40d7960
SHA512

3a219f76fbd2277c98dd76444cb0204b06784f17a581e8bd0f18b02e6995c255748a41981eed24832abebf3777819b7f54af8ef25f0a16395270b025ce6eb2d4
SSDEEP

1536:cCYLIsc18O4jMdYsWaaK6dOo2XxMP24cQPuNK8:cCCIscTCaH6UnxpOuNJ

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/840-0-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral1/memory/840-2-0x0000000000400000-0x0000000000415000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2992	840	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
840	397607cffa2e12539ffc34d169187f30_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 2992	840	397607cffa2e12539ffc34d169187f30_NeikiAnalytics.exe	29
PID 840 wrote to memory of 2992	840	397607cffa2e12539ffc34d169187f30_NeikiAnalytics.exe	29
PID 840 wrote to memory of 2992	840	397607cffa2e12539ffc34d169187f30_NeikiAnalytics.exe	29
PID 840 wrote to memory of 2992	840	397607cffa2e12539ffc34d169187f30_NeikiAnalytics.exe	29

C:\Users\Admin\AppData\Local\Temp\397607cffa2e12539ffc34d169187f30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\397607cffa2e12539ffc34d169187f30_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 124
  2⤵
  - Program crash
  PID:2992

memory/840-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/840-1-0x0000000000020000-0x0000000000026000-memory.dmp

Filesize
24KB

Download
memory/840-2-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download