20ff579c334fd9ebaa069c09501153a09f2ab3a68fb82021f56d5aca13de52a8

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 06:12

Target

ae14f4ea32d68c79321199ff972b5510_NeikiAnalytics.exe
Size

887KB
MD5

ae14f4ea32d68c79321199ff972b5510
SHA1

6e97230e16f06d7f0f62ae4cb0d017c2459f0278
SHA256

20ff579c334fd9ebaa069c09501153a09f2ab3a68fb82021f56d5aca13de52a8
SHA512

989c9dbda80b60613b657780c708e4e560668cbd89a6f925b08f32d4caa33d7de66760ec70df0cf137fdfb2c9a2f8c089e19c414d1bb314466650dcd2405fbca
SSDEEP

12288:zASuATvhwtqV3OUQhQeXJZR8oPjVDa/ZSN:BTvhKqV3OvXpr9a/ZSN

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2556	ae14f4ea32d68c79321199ff972b5510_NeikiAnalytics.exe

Loads dropped DLL 4 IoCs

pid	Process
2120	ae14f4ea32d68c79321199ff972b5510_NeikiAnalytics.exe
2628	WerFault.exe
2628	WerFault.exe
2628	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2628	2556	WerFault.exe	29

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2120	ae14f4ea32d68c79321199ff972b5510_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2556	ae14f4ea32d68c79321199ff972b5510_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2556	2120	ae14f4ea32d68c79321199ff972b5510_NeikiAnalytics.exe	29
PID 2120 wrote to memory of 2556	2120	ae14f4ea32d68c79321199ff972b5510_NeikiAnalytics.exe	29
PID 2120 wrote to memory of 2556	2120	ae14f4ea32d68c79321199ff972b5510_NeikiAnalytics.exe	29
PID 2120 wrote to memory of 2556	2120	ae14f4ea32d68c79321199ff972b5510_NeikiAnalytics.exe	29
PID 2556 wrote to memory of 2628	2556	ae14f4ea32d68c79321199ff972b5510_NeikiAnalytics.exe	30
PID 2556 wrote to memory of 2628	2556	ae14f4ea32d68c79321199ff972b5510_NeikiAnalytics.exe	30
PID 2556 wrote to memory of 2628	2556	ae14f4ea32d68c79321199ff972b5510_NeikiAnalytics.exe	30
PID 2556 wrote to memory of 2628	2556	ae14f4ea32d68c79321199ff972b5510_NeikiAnalytics.exe	30

\Users\Admin\AppData\Local\Temp\ae14f4ea32d68c79321199ff972b5510_NeikiAnalytics.exe

Filesize
887KB

MD5
91a2eb77c9e4f947574d18f961ca8a70

SHA1
d27f3da6dea424544043d538999f151cb6d6564e

SHA256
2fad7bca9752ae4d3b1821c5540be7868199b16d7f10c8bce6ee187763572521

SHA512
650243b158569927a7974d8069e04bf329023458e1bea7ffbd57801d74eba01aff95bfb3110206888ae9488b96ca2571cfababa0cc78c3e54aba0388679980d0

Download Submit
memory/2120-0-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/2120-6-0x00000000030B0000-0x000000000319D000-memory.dmp

Filesize
948KB

Download
memory/2120-9-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/2556-10-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/2556-11-0x0000000002E00000-0x0000000002EED000-memory.dmp

Filesize
948KB

Download