Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 17:52
Behavioral task
behavioral1
Sample
00ff4a5b2b7ebef69e98b200e18f6730_NeikiAnalytics.exe
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
00ff4a5b2b7ebef69e98b200e18f6730_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
1 signatures
150 seconds
General
-
Target
00ff4a5b2b7ebef69e98b200e18f6730_NeikiAnalytics.exe
-
Size
155KB
-
MD5
00ff4a5b2b7ebef69e98b200e18f6730
-
SHA1
6a7aa33312cd33fa1a15797ded59d374005a71d1
-
SHA256
71d1570afefcf1601bc269a5a3d874e7ce68bc6fa947ee4171b2a9c56185226d
-
SHA512
ef7fa666a4220f1799bd1d0a6c4934c2bc4400bb39029354c96a5f82cff5b965d62ae8208d10929f8dc82fc88d75962094a5ca49f2f49e7457804ebad8bab7e9
-
SSDEEP
3072:S5K/B0toLMSNJTlxwsx89TSdBgjMqqDL2/TOKpgG:ScytwRCTTSdBgQqqDL6SKz
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2028 2156 WerFault.exe 00ff4a5b2b7ebef69e98b200e18f6730_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
00ff4a5b2b7ebef69e98b200e18f6730_NeikiAnalytics.exedescription pid process target process PID 2156 wrote to memory of 2028 2156 00ff4a5b2b7ebef69e98b200e18f6730_NeikiAnalytics.exe WerFault.exe PID 2156 wrote to memory of 2028 2156 00ff4a5b2b7ebef69e98b200e18f6730_NeikiAnalytics.exe WerFault.exe PID 2156 wrote to memory of 2028 2156 00ff4a5b2b7ebef69e98b200e18f6730_NeikiAnalytics.exe WerFault.exe PID 2156 wrote to memory of 2028 2156 00ff4a5b2b7ebef69e98b200e18f6730_NeikiAnalytics.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00ff4a5b2b7ebef69e98b200e18f6730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\00ff4a5b2b7ebef69e98b200e18f6730_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 882⤵
- Program crash
PID:2028