0d311f8d9493cfba7258c462a5ddfa8d91cbe1ea1159113392e9d5d1803f551d

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 21:41

Target

3ca38f9a692bc691f1617dd5b2eb68f0_NeikiAnalytics.exe
Size

1.0MB
MD5

3ca38f9a692bc691f1617dd5b2eb68f0
SHA1

e715e66e2bbb98b5e7cdc51afd32a338b8ecab23
SHA256

0d311f8d9493cfba7258c462a5ddfa8d91cbe1ea1159113392e9d5d1803f551d
SHA512

d27595b37fee33fa2b5169305c3e8d41a747b56adb2e7f2587a9332c3dcca2cc74ba5a1b1974e0d448cb22869bba2b4e9127b2f5f08677b620d16894e72319a2
SSDEEP

12288:/qSlA8a3KkDuywWjVDaPZSVTzH3hf8Ctzu:ySHNUaPZSVTb+eK

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1524	3ca38f9a692bc691f1617dd5b2eb68f0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
1524	3ca38f9a692bc691f1617dd5b2eb68f0_NeikiAnalytics.exe

Loads dropped DLL 4 IoCs

pid	Process
3016	3ca38f9a692bc691f1617dd5b2eb68f0_NeikiAnalytics.exe
2612	WerFault.exe
2612	WerFault.exe
2612	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2612	1524	WerFault.exe	29

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3016	3ca38f9a692bc691f1617dd5b2eb68f0_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1524	3ca38f9a692bc691f1617dd5b2eb68f0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 1524	3016	3ca38f9a692bc691f1617dd5b2eb68f0_NeikiAnalytics.exe	29
PID 3016 wrote to memory of 1524	3016	3ca38f9a692bc691f1617dd5b2eb68f0_NeikiAnalytics.exe	29
PID 3016 wrote to memory of 1524	3016	3ca38f9a692bc691f1617dd5b2eb68f0_NeikiAnalytics.exe	29
PID 3016 wrote to memory of 1524	3016	3ca38f9a692bc691f1617dd5b2eb68f0_NeikiAnalytics.exe	29
PID 1524 wrote to memory of 2612	1524	3ca38f9a692bc691f1617dd5b2eb68f0_NeikiAnalytics.exe	30
PID 1524 wrote to memory of 2612	1524	3ca38f9a692bc691f1617dd5b2eb68f0_NeikiAnalytics.exe	30
PID 1524 wrote to memory of 2612	1524	3ca38f9a692bc691f1617dd5b2eb68f0_NeikiAnalytics.exe	30
PID 1524 wrote to memory of 2612	1524	3ca38f9a692bc691f1617dd5b2eb68f0_NeikiAnalytics.exe	30

\Users\Admin\AppData\Local\Temp\3ca38f9a692bc691f1617dd5b2eb68f0_NeikiAnalytics.exe

Filesize
1.0MB

MD5
9e825c5d7a5f49a8a45af05b54181719

SHA1
14214c0f2ed1cfcc3e3f9cd46669be9ff065906c

SHA256
6a9c33cc33658c4a403ec1cd193d7e08365cd232796758accd56ab028a4737b2

SHA512
0531b16f3214005a85fdbf17c121469067a9a58f963feceeb0dab04270c2bda70b923c8e5e4cb81d8eb480105d0250215a7010caa1a6699e2915133a3c3d862c

Download Submit
memory/1524-9-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/1524-10-0x0000000002E90000-0x0000000002F7C000-memory.dmp

Filesize
944KB

Download
memory/3016-0-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/3016-7-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download