14e8b7fe64d4b466aba87b6f4eea6743df6f3c633214e76e79e56214695a88c0

Analysis

max time kernel
141s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 22:13

Target

96290537885c36544a366bf41a29ff00_NeikiAnalytics.exe
Size

2.6MB
MD5

96290537885c36544a366bf41a29ff00
SHA1

427e4cd7a4c9fd02074b4a560c06d94997569340
SHA256

14e8b7fe64d4b466aba87b6f4eea6743df6f3c633214e76e79e56214695a88c0
SHA512

37040f4faa87607acc3e13dfce632e46505a376a4b48e94509240c3050add31c672c40e06b2590b2c494dc1acc5588a86db40d2f5758be5f9da8bd55e5eaf9e9
SSDEEP

49152:lSqI2Lj9eY+WTXqUlqZbj+wFPTnNd00Ee9jTFO5vAse8d8YU26jH3HdpF:QGevW79UZf+wFP5/lTM54sv/U26z39z

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3028-0-0x0000000000400000-0x0000000000D25000-memory.dmp	upx
behavioral1/memory/3028-9-0x0000000000400000-0x0000000000D25000-memory.dmp	upx
behavioral1/memory/3028-20-0x0000000000400000-0x0000000000D25000-memory.dmp	upx

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1800	3028	96290537885c36544a366bf41a29ff00_NeikiAnalytics.exe	28
PID 3028 wrote to memory of 1800	3028	96290537885c36544a366bf41a29ff00_NeikiAnalytics.exe	28
PID 3028 wrote to memory of 1800	3028	96290537885c36544a366bf41a29ff00_NeikiAnalytics.exe	28
PID 3028 wrote to memory of 1800	3028	96290537885c36544a366bf41a29ff00_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\96290537885c36544a366bf41a29ff00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\96290537885c36544a366bf41a29ff00_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1800

memory/3028-0-0x0000000000400000-0x0000000000D25000-memory.dmp

Filesize
9.1MB

Download
memory/3028-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/3028-2-0x0000000003F80000-0x0000000003F81000-memory.dmp

Filesize
4KB

Download
memory/3028-3-0x0000000004C00000-0x0000000004C01000-memory.dmp

Filesize
4KB

Download
memory/3028-5-0x0000000005090000-0x0000000005091000-memory.dmp

Filesize
4KB

Download
memory/3028-4-0x0000000004D10000-0x0000000004D11000-memory.dmp

Filesize
4KB

Download
memory/3028-7-0x0000000005AE0000-0x0000000005AE1000-memory.dmp

Filesize
4KB

Download
memory/3028-9-0x0000000000400000-0x0000000000D25000-memory.dmp

Filesize
9.1MB

Download
memory/3028-10-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/3028-11-0x0000000003F80000-0x0000000003F81000-memory.dmp

Filesize
4KB

Download
memory/3028-12-0x0000000004C00000-0x0000000004C01000-memory.dmp

Filesize
4KB

Download
memory/3028-13-0x0000000004D10000-0x0000000004D11000-memory.dmp

Filesize
4KB

Download
memory/3028-15-0x0000000005090000-0x0000000005091000-memory.dmp

Filesize
4KB

Download
memory/3028-16-0x0000000005AE0000-0x0000000005AE1000-memory.dmp

Filesize
4KB

Download
memory/3028-20-0x0000000000400000-0x0000000000D25000-memory.dmp

Filesize
9.1MB

Download