2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 09:28

Target

2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe
Size

1.1MB
MD5

6d556c7f2e369909751dd05c36f68fc0
SHA1

daed187d954e65fd0eae244e5827beec1ea94d8b
SHA256

2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a
SHA512

0898288b61ce86a485a72f5de1b82d0a13f52b22230d0f28a805c0b2ae7b224c9e7c382518ef1e51645e2ed9e0c79d5a9cce8af63cb31fe9bbfe5d0031664ebc
SSDEEP

12288:gsVaX0DQJd7qD7/jVDa/ZSoPDm3Xx/MCtjm:gsVaX0sJsa/ZSoPDQ+ey

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2680	2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2680	2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe

Loads dropped DLL 4 IoCs

pid	Process
2888	2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe
3032	WerFault.exe
3032	WerFault.exe
3032	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3032	2680	WerFault.exe	29

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2888	2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2680	2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2680	2888	2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe	29
PID 2888 wrote to memory of 2680	2888	2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe	29
PID 2888 wrote to memory of 2680	2888	2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe	29
PID 2888 wrote to memory of 2680	2888	2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe	29
PID 2680 wrote to memory of 3032	2680	2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe	30
PID 2680 wrote to memory of 3032	2680	2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe	30
PID 2680 wrote to memory of 3032	2680	2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe	30
PID 2680 wrote to memory of 3032	2680	2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe	30

\Users\Admin\AppData\Local\Temp\2c2f712e273925094d427a034e1b8d71bc55dc2d464a73095969f36041425d1a_NeikiAnalytics.exe

Filesize
1.1MB

MD5
df4754fe001baa28bca5bca34459181c

SHA1
ea57861158c9d5f4e14bed951fa58cb286391d1c

SHA256
c325459cd112cc8ebb7788f044d53c9b564d7daa3118f9f596255e413b3c26b5

SHA512
d68416cd46e2896511f99d586b4e95d737b2742d1bd238e53fae715c47d0df889a16b774bfe5472192a44c13e4e70ff3a9466f0687dc5a40ad4174a7a7d85a0b

Download Submit
memory/2680-9-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2680-10-0x0000000002E40000-0x0000000002F30000-memory.dmp

Filesize
960KB

Download
memory/2680-15-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2888-0-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2888-7-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2888-14-0x0000000002FD0000-0x00000000030C0000-memory.dmp

Filesize
960KB

Download