fakeav | b85e4563408d12bbcc3c35046962c80969f0d131b0d8373ab0404c7bb8f3b734

Analysis

max time kernel
142s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-05-2024 16:23

Target

f11ca757a85e5e0bbac7407211614330_NeikiAnalytics.exe
Size

724KB
MD5

f11ca757a85e5e0bbac7407211614330
SHA1

0f71fb74675a23dc64e0f7b1d36a21b1800a4347
SHA256

b85e4563408d12bbcc3c35046962c80969f0d131b0d8373ab0404c7bb8f3b734
SHA512

27c68244aa9b082fd0b6ad342aa37c9b97fa56b2985747005f4b90f925814d64ce6c262e26efc0ba4d0139ee9ff4e1b7ac6b93cf6dedccb25bc721e94f5e63d4
SSDEEP

12288:7B6jfu9W5qVnpA1P9mTx87m7HGA04OBGaSuQalOZeW0dp45X+pd167QhEQJ:167MnVnpA1lmTx8MmA07AaSuDSwde5E1

Score

10^/10

FakeAV, RogueAntivirus
FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.
fakeav spyware fakeav

FakeAV payload 1 IoCs

fakeav spyware

resource	yara_rule
behavioral1/memory/2148-0-0x0000000000400000-0x00000000004C1000-memory.dmp	fakeav

Program crash 1 IoCs

pid	pid_target	Process
2912	2148	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2912	2148	f11ca757a85e5e0bbac7407211614330_NeikiAnalytics.exe	28
PID 2148 wrote to memory of 2912	2148	f11ca757a85e5e0bbac7407211614330_NeikiAnalytics.exe	28
PID 2148 wrote to memory of 2912	2148	f11ca757a85e5e0bbac7407211614330_NeikiAnalytics.exe	28
PID 2148 wrote to memory of 2912	2148	f11ca757a85e5e0bbac7407211614330_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\f11ca757a85e5e0bbac7407211614330_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\f11ca757a85e5e0bbac7407211614330_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 176
  2⤵
  - Program crash
  PID:2912

memory/2148-0-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download