8bb3a284cd23456236bf4c8ce32d2c8183b95d85f9c8056ea36ff543bb85f722

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 06:53 UTC

Target

e77baf2f115d23c33c1cb8c29c0e3c20_NeikiAnalytics.exe
Size

1.0MB
MD5

e77baf2f115d23c33c1cb8c29c0e3c20
SHA1

f5d6b1c2cb96b207e47122e7be21c5568cbd2100
SHA256

8bb3a284cd23456236bf4c8ce32d2c8183b95d85f9c8056ea36ff543bb85f722
SHA512

56fb44b7f005b515529966d50b493111932cdc9062a38e7dce677273ea394273fbb13e737f025195d4074d962772aeabe7a1e1cc700c8238bc70acd0714bb338
SSDEEP

12288:2hyKW7Y751dqmNM1CBIouDPjVDa/ZSBHnhvMCtjW:Rl7YTwIM1CBIo49a/ZSFueC

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2456	e77baf2f115d23c33c1cb8c29c0e3c20_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2456	e77baf2f115d23c33c1cb8c29c0e3c20_NeikiAnalytics.exe

Loads dropped DLL 4 IoCs

pid	Process
1904	e77baf2f115d23c33c1cb8c29c0e3c20_NeikiAnalytics.exe
1248	WerFault.exe
1248	WerFault.exe
1248	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1248	2456	WerFault.exe	29

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1904	e77baf2f115d23c33c1cb8c29c0e3c20_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2456	e77baf2f115d23c33c1cb8c29c0e3c20_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2456	1904	e77baf2f115d23c33c1cb8c29c0e3c20_NeikiAnalytics.exe	29
PID 1904 wrote to memory of 2456	1904	e77baf2f115d23c33c1cb8c29c0e3c20_NeikiAnalytics.exe	29
PID 1904 wrote to memory of 2456	1904	e77baf2f115d23c33c1cb8c29c0e3c20_NeikiAnalytics.exe	29
PID 1904 wrote to memory of 2456	1904	e77baf2f115d23c33c1cb8c29c0e3c20_NeikiAnalytics.exe	29
PID 2456 wrote to memory of 1248	2456	e77baf2f115d23c33c1cb8c29c0e3c20_NeikiAnalytics.exe	30
PID 2456 wrote to memory of 1248	2456	e77baf2f115d23c33c1cb8c29c0e3c20_NeikiAnalytics.exe	30
PID 2456 wrote to memory of 1248	2456	e77baf2f115d23c33c1cb8c29c0e3c20_NeikiAnalytics.exe	30
PID 2456 wrote to memory of 1248	2456	e77baf2f115d23c33c1cb8c29c0e3c20_NeikiAnalytics.exe	30

\Users\Admin\AppData\Local\Temp\e77baf2f115d23c33c1cb8c29c0e3c20_NeikiAnalytics.exe

Filesize
1.0MB

MD5
0e36e39e0027d3bc7c9b16561ee3b1a0

SHA1
f31bf6874079e2c6638e28f8669d007a1b37c347

SHA256
4da72c75a617b2a37cfeff8e49a5c6989bbe272d2152933cdf8262c84d79c7cc

SHA512
03dedfa5034148b7bf6459b993987e78a0e31aff44a2e82ae843d0ed8d5a10039c7f4add193a4043d469699c77fa853361da7217c6755571c4c9b43629929cf5

Download Submit
memory/1904-0-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/1904-6-0x0000000002FB0000-0x000000000309D000-memory.dmp

Filesize
948KB

Download
memory/1904-8-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/2456-10-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/2456-11-0x0000000002E00000-0x0000000002EED000-memory.dmp

Filesize
948KB

Download