64c986ed191b832b894f6db4c6b96186686479753c9580afe30aef0f4adce888

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 08:39

Target

4d5bdaf7406fdbadea65a9ffc373c4d0_NeikiAnalytics.exe
Size

653KB
MD5

4d5bdaf7406fdbadea65a9ffc373c4d0
SHA1

01de4682a56099ba0de8d9f32a5b14a5aa060288
SHA256

64c986ed191b832b894f6db4c6b96186686479753c9580afe30aef0f4adce888
SHA512

55dba06d19a3f25dc31f2419622f03f9e9e08f043ee7bdf8941b48cbf2bbf2bd978dcdeb84ac2e7140eed58960ed701316a4f21538176a83356dc38e1d6f2877
SSDEEP

12288:Q3ggq6MaimNk28Rz17yJRJLyt2BDyE7TNW9yyfA5KW7/il+MRjWAehRk+y:j7vmp8Rz1GJR8AB+Is9yvr7/jkf

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2360-0-0x000000013F7B0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/memory/2360-2-0x000000013F7B0000-0x000000013FBD2000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2984	2360	4d5bdaf7406fdbadea65a9ffc373c4d0_NeikiAnalytics.exe	29
PID 2360 wrote to memory of 2984	2360	4d5bdaf7406fdbadea65a9ffc373c4d0_NeikiAnalytics.exe	29
PID 2360 wrote to memory of 2984	2360	4d5bdaf7406fdbadea65a9ffc373c4d0_NeikiAnalytics.exe	29

C:\Users\Admin\AppData\Local\Temp\4d5bdaf7406fdbadea65a9ffc373c4d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4d5bdaf7406fdbadea65a9ffc373c4d0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2360 -s 84
  2⤵
  PID:2984

memory/2360-0-0x000000013F7B0000-0x000000013FBD2000-memory.dmp

Filesize
4.1MB

Download
memory/2360-1-0x0000000000300000-0x0000000000320000-memory.dmp

Filesize
128KB

Download
memory/2360-2-0x000000013F7B0000-0x000000013FBD2000-memory.dmp

Filesize
4.1MB

Download