6c312040ba75691cbf445fa872a13bb39e30ee1bbb69750e262ded1608b9e155

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 05:27

Target

0f5cba8a7792360c8ec1219401363d10_NeikiAnalytics.exe
Size

904KB
MD5

0f5cba8a7792360c8ec1219401363d10
SHA1

7f92887ea12d52008794931e407ea8d1cdd25b33
SHA256

6c312040ba75691cbf445fa872a13bb39e30ee1bbb69750e262ded1608b9e155
SHA512

6e9b2791270013914be2382b81e02f1af64abe0f9f768c290518b83b87de7994f8e515e76bc4ff29c716d0a3fc1074cac683412371dc24abbae8a731d118f9f9
SSDEEP

6144:4Abzs0MoytksCXVXhLVK6sjRHQwuKwABbxxJa/YES44sDx:vioyoXN5sHjVDa/ZS4fDx

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2968	0f5cba8a7792360c8ec1219401363d10_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2968	0f5cba8a7792360c8ec1219401363d10_NeikiAnalytics.exe

Loads dropped DLL 4 IoCs

pid	Process
2476	0f5cba8a7792360c8ec1219401363d10_NeikiAnalytics.exe
2496	WerFault.exe
2496	WerFault.exe
2496	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2496	2968	WerFault.exe	29

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2476	0f5cba8a7792360c8ec1219401363d10_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2968	0f5cba8a7792360c8ec1219401363d10_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2968	2476	0f5cba8a7792360c8ec1219401363d10_NeikiAnalytics.exe	29
PID 2476 wrote to memory of 2968	2476	0f5cba8a7792360c8ec1219401363d10_NeikiAnalytics.exe	29
PID 2476 wrote to memory of 2968	2476	0f5cba8a7792360c8ec1219401363d10_NeikiAnalytics.exe	29
PID 2476 wrote to memory of 2968	2476	0f5cba8a7792360c8ec1219401363d10_NeikiAnalytics.exe	29
PID 2968 wrote to memory of 2496	2968	0f5cba8a7792360c8ec1219401363d10_NeikiAnalytics.exe	30
PID 2968 wrote to memory of 2496	2968	0f5cba8a7792360c8ec1219401363d10_NeikiAnalytics.exe	30
PID 2968 wrote to memory of 2496	2968	0f5cba8a7792360c8ec1219401363d10_NeikiAnalytics.exe	30
PID 2968 wrote to memory of 2496	2968	0f5cba8a7792360c8ec1219401363d10_NeikiAnalytics.exe	30

\Users\Admin\AppData\Local\Temp\0f5cba8a7792360c8ec1219401363d10_NeikiAnalytics.exe

Filesize
904KB

MD5
9339af6c30ba44679461167e7b1cec53

SHA1
2564424da9a45eb4d13597817cd8fd64b977c832

SHA256
089bf96c0a9cf7107e59f3c4900890a03f1b26c5e311ebb357bf3d87d590fd10

SHA512
8c327906ffe7799fbde4af16629e8cbde9a681f91be9544893010ad75d8719d81a38fcb28af9166ebab09d4dd0b50a0d63a791038b24c83865521dac3a981fe4

Download Submit
memory/2476-0-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2476-6-0x00000000014F0000-0x00000000015DF000-memory.dmp

Filesize
956KB

Download
memory/2476-8-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2968-10-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/2968-11-0x0000000002ED0000-0x0000000002FBF000-memory.dmp

Filesize
956KB

Download
memory/2968-15-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download