fakeav | b85e4563408d12bbcc3c35046962c80969f0d131b0d8373ab0404c7bb8f3b734

Analysis

max time kernel
141s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 16:23

Target
f11ca757a85e5e0bbac7407211614330_NeikiAnalytics.exe
Size 724KB
Sample240519-tvsf5sfa99
SHA256 b85e4563408d12bbcc3c35046962c80969f0d131b0d8373ab0404c7bb8f3b734
MD5 f11ca757a85e5e0bbac7407211614330
SHA1 0f71fb74675a23dc64e0f7b1d36a21b1800a4347
SHA512 27c68244aa9b082fd0b6ad342aa37c9b97fa56b2985747005f4b90f925814d64ce6c262e26efc0ba4d0139ee9ff4e1b7ac6b93cf6dedccb25bc721e94f5e63d4
SSDEEP 12288:7B6jfu9W5qVnpA1P9mTx87m7HGA04OBGaSuQalOZeW0dp45X+pd167QhEQJ:167MnVnpA1lmTx8MmA07AaSuDSwde5E1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

FakeAV, RogueAntivirus
FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.
fakeav spyware fakeav

FakeAV payload 1 IoCs

fakeav spyware

resource	yara_rule
behavioral2/memory/1960-0-0x0000000000400000-0x00000000004C1000-memory.dmp	fakeav

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1268	1960	WerFault.exe	82

C:\Users\Admin\AppData\Local\Temp\f11ca757a85e5e0bbac7407211614330_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\f11ca757a85e5e0bbac7407211614330_NeikiAnalytics.exe"
1⤵
PID:1960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 492
  2⤵
  - Program crash
  PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1960 -ip 1960
1⤵
PID:2316

memory/1960-0-0x0000000000400000-0x00000000004C1000-memory.dmp

Download