e3e99e31c614ccbd645156b25469d87c139003814fc0975a1a530f8ece39822c

Analysis

max time kernel
144s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:57

Target

7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe
Size

632KB
MD5

7d4811b28f75404e7b666bb10651af50
SHA1

efe8751b4c3df9e6bbb336b0c435228831031bff
SHA256

e3e99e31c614ccbd645156b25469d87c139003814fc0975a1a530f8ece39822c
SHA512

a854b9d140946d5e3c545a155120a88ec405fc598275240c8feaf6b17f2ad8c4b942751f4da67678d817d1c4c0607835a839321af999c6cadf22d8858d7020ed
SSDEEP

12288:+58JKQ1uBeAMlwesHU8wqy2VYCIbvpOBlU1RlgIDMCZgjtGlxHZ9/I:eJ1SwPHU8X31PfU17DhZy0lxHZ9/I

Score

7^/10

Executes dropped EXE 2 IoCs

Processes:

alg.exe

pid process

476
1812 alg.exe

pid	process
476
1812	alg.exe

Drops file in System32 directory 2 IoCs

Processes:

7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exealg.exe

description	ioc	process
File opened for modification	C:\Windows\System32\alg.exe	7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4cf056f5ad1aea39.bin	alg.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2772 884 WerFault.exe 7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe

description pid process

Token: SeTakeOwnershipPrivilege 884 7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe

pid	pid_target	process	target process
2772	884	WerFault.exe	7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	884	7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe

description	pid	process	target process
PID 884 wrote to memory of 2772	884	7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe	WerFault.exe
PID 884 wrote to memory of 2772	884	7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe	WerFault.exe
PID 884 wrote to memory of 2772	884	7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe	WerFault.exe
PID 884 wrote to memory of 2772	884	7d4811b28f75404e7b666bb10651af50_NeikiAnalytics.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 160
2⤵
- Program crash
PID:2772

\Windows\System32\alg.exe
Filesize
644KB

MD5
0f903c420fbf5ca0c43991b363167f45

SHA1
070a596cfe5980b0e6e8b6ea0f76bdb535e952cf

SHA256
036fb7b8cca540a3adab62b919597cbc4058f60f1ff475e31b621d7bb8a186f0

SHA512
e041b0df87fc7785062549d485e3beaccf318262a119dc658855c9398e58f5f7dda2d1d053b618f7f5ef5ae55981da2df7e5e7a05928dfe80db0b2e8bf54e64f

Download Submit
memory/884-0-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/884-1-0x0000000000220000-0x0000000000287000-memory.dmp

Filesize
412KB

Download
memory/884-8-0x0000000000220000-0x0000000000287000-memory.dmp

Filesize
412KB

Download
memory/884-24-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/1812-13-0x0000000100000000-0x00000001000A4000-memory.dmp

Filesize
656KB

Download
memory/1812-14-0x00000000008C0000-0x0000000000920000-memory.dmp

Filesize
384KB

Download
memory/1812-22-0x00000000008C0000-0x0000000000920000-memory.dmp

Filesize
384KB

Download
memory/1812-25-0x0000000100000000-0x00000001000A4000-memory.dmp

Filesize
656KB

Download