fakeav | b85e4563408d12bbcc3c35046962c80969f0d131b0d8373ab0404c7bb8f3b734

Analysis

max time kernel
141s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2024 16:23

Target

f11ca757a85e5e0bbac7407211614330_NeikiAnalytics.exe
Size

724KB
MD5

f11ca757a85e5e0bbac7407211614330
SHA1

0f71fb74675a23dc64e0f7b1d36a21b1800a4347
SHA256

b85e4563408d12bbcc3c35046962c80969f0d131b0d8373ab0404c7bb8f3b734
SHA512

27c68244aa9b082fd0b6ad342aa37c9b97fa56b2985747005f4b90f925814d64ce6c262e26efc0ba4d0139ee9ff4e1b7ac6b93cf6dedccb25bc721e94f5e63d4
SSDEEP

12288:7B6jfu9W5qVnpA1P9mTx87m7HGA04OBGaSuQalOZeW0dp45X+pd167QhEQJ:167MnVnpA1lmTx8MmA07AaSuDSwde5E1

Score

10^/10

FakeAV, RogueAntivirus
FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.
fakeav spyware fakeav

FakeAV payload 1 IoCs

fakeav spyware

Processes:

resource	yara_rule
behavioral2/memory/1960-0-0x0000000000400000-0x00000000004C1000-memory.dmp	fakeav

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1268 1960 WerFault.exe f11ca757a85e5e0bbac7407211614330_NeikiAnalytics.exe

pid	pid_target	process	target process
1268	1960	WerFault.exe	f11ca757a85e5e0bbac7407211614330_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\f11ca757a85e5e0bbac7407211614330_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\f11ca757a85e5e0bbac7407211614330_NeikiAnalytics.exe"
1⤵
PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 492
2⤵
- Program crash
PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1960 -ip 1960
1⤵
PID:2316

memory/1960-0-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download