edfa90b9dbabb747cacafee9e20a62f2516d14dbf2411a67efe73ff0d787661d

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 13:13

Target

b99384011a78763aefc058d38beec290_NeikiAnalytics.exe
Size

960KB
MD5

b99384011a78763aefc058d38beec290
SHA1

b925d22fbb35be935495f25cbc500c905165daa8
SHA256

edfa90b9dbabb747cacafee9e20a62f2516d14dbf2411a67efe73ff0d787661d
SHA512

6fd9dcbdb2b7b96af9e97c6af49d60b958235ac147a0c1a36be907ff57919fb154b5e16c5d0584f045b201b72278b348a970bfa4153466594c29dc4d5f57fa41
SSDEEP

12288:tAIJaUwn/NAzQUpvrHjVDa/ZS4fD2Hnh6:tA6av/uzQ0vrFa/ZS4fDw8

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2364	b99384011a78763aefc058d38beec290_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2364	b99384011a78763aefc058d38beec290_NeikiAnalytics.exe

Loads dropped DLL 4 IoCs

pid	Process
2180	b99384011a78763aefc058d38beec290_NeikiAnalytics.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2220	2364	WerFault.exe	29

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2180	b99384011a78763aefc058d38beec290_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2364	b99384011a78763aefc058d38beec290_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2364	2180	b99384011a78763aefc058d38beec290_NeikiAnalytics.exe	29
PID 2180 wrote to memory of 2364	2180	b99384011a78763aefc058d38beec290_NeikiAnalytics.exe	29
PID 2180 wrote to memory of 2364	2180	b99384011a78763aefc058d38beec290_NeikiAnalytics.exe	29
PID 2180 wrote to memory of 2364	2180	b99384011a78763aefc058d38beec290_NeikiAnalytics.exe	29
PID 2364 wrote to memory of 2220	2364	b99384011a78763aefc058d38beec290_NeikiAnalytics.exe	30
PID 2364 wrote to memory of 2220	2364	b99384011a78763aefc058d38beec290_NeikiAnalytics.exe	30
PID 2364 wrote to memory of 2220	2364	b99384011a78763aefc058d38beec290_NeikiAnalytics.exe	30
PID 2364 wrote to memory of 2220	2364	b99384011a78763aefc058d38beec290_NeikiAnalytics.exe	30

\Users\Admin\AppData\Local\Temp\b99384011a78763aefc058d38beec290_NeikiAnalytics.exe

Filesize
960KB

MD5
488803c6b8e2feceb2c7f1285d44d02b

SHA1
56a2e525d05a6c7abc91f5ea1ceb33b0643e74c0

SHA256
120f9e046bbc162c0eeafe51ad56ea33ebf62489e6f208bd7fee14b99ed2f6dc

SHA512
49e28ecde81cb4962f5e70acedc93fdfae06cfda8c75ba00785e498c3dcffa918b6da4dcf0e7a294650a82000db8f5132e351ebf5619e5bf31f491aee00a809d

Download Submit
memory/2180-0-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2180-9-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2180-6-0x0000000003010000-0x0000000003100000-memory.dmp

Filesize
960KB

Download
memory/2364-10-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2364-11-0x0000000002E00000-0x0000000002EF0000-memory.dmp

Filesize
960KB

Download
memory/2364-15-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download