61b0faf633103e1f1816c43b9e4d9d2919849d0d70399dc9dbd81d0a554c2248

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 04:13

Target

31e140617cee9fc7e4bb6003606abd50_NeikiAnalytics.exe
Size

1.1MB
MD5

31e140617cee9fc7e4bb6003606abd50
SHA1

7ebac3d194472b3c45f16e91a567f0bf50132645
SHA256

61b0faf633103e1f1816c43b9e4d9d2919849d0d70399dc9dbd81d0a554c2248
SHA512

683f1d5478de19ec3e7662f6a8b1e2b909f9f28c6a6aad33ed8e8653887eb94739be3de18640e9c26b214e5b518527fdbec21023298a449db206d0a92f110eda
SSDEEP

12288:0o6nZUqZ3aezznsQ7VhwjjVDa/ZSoPDm3Xx/MCtjm:0oOUqZ3cQfAa/ZSoPDQ+ey

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2952	31e140617cee9fc7e4bb6003606abd50_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2952	31e140617cee9fc7e4bb6003606abd50_NeikiAnalytics.exe

Loads dropped DLL 4 IoCs

pid	Process
1484	31e140617cee9fc7e4bb6003606abd50_NeikiAnalytics.exe
2096	WerFault.exe
2096	WerFault.exe
2096	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2096	2952	WerFault.exe	29

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1484	31e140617cee9fc7e4bb6003606abd50_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2952	31e140617cee9fc7e4bb6003606abd50_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 2952	1484	31e140617cee9fc7e4bb6003606abd50_NeikiAnalytics.exe	29
PID 1484 wrote to memory of 2952	1484	31e140617cee9fc7e4bb6003606abd50_NeikiAnalytics.exe	29
PID 1484 wrote to memory of 2952	1484	31e140617cee9fc7e4bb6003606abd50_NeikiAnalytics.exe	29
PID 1484 wrote to memory of 2952	1484	31e140617cee9fc7e4bb6003606abd50_NeikiAnalytics.exe	29
PID 2952 wrote to memory of 2096	2952	31e140617cee9fc7e4bb6003606abd50_NeikiAnalytics.exe	30
PID 2952 wrote to memory of 2096	2952	31e140617cee9fc7e4bb6003606abd50_NeikiAnalytics.exe	30
PID 2952 wrote to memory of 2096	2952	31e140617cee9fc7e4bb6003606abd50_NeikiAnalytics.exe	30
PID 2952 wrote to memory of 2096	2952	31e140617cee9fc7e4bb6003606abd50_NeikiAnalytics.exe	30

\Users\Admin\AppData\Local\Temp\31e140617cee9fc7e4bb6003606abd50_NeikiAnalytics.exe

Filesize
1.1MB

MD5
3a2a629a1bb084ce5f1b4f01bd533311

SHA1
c7e8c3d9073a5202eaba6b03359badfef0255189

SHA256
6092a79c3339ef8fc112531a8aaae2ac809cfe6849f61151d2f35ed6efdd8b43

SHA512
95cb7b134dc6e7c095379d387d5929f7a61d2244a19a463e4c10b6028aab2fbc7444f83ba3400142622fa0b58d7c072759e49396177e2684244368860ef836ff

Download Submit
memory/1484-0-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/1484-6-0x0000000003080000-0x0000000003170000-memory.dmp

Filesize
960KB

Download
memory/1484-9-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2952-10-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2952-11-0x0000000002ED0000-0x0000000002FC0000-memory.dmp

Filesize
960KB

Download
memory/2952-15-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download