fakeav | 6646480917b24492ac7cedf3ab5fd59a53bae63a07d25dd119ebea9ce805b879

Analysis

max time kernel
142s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 04:01

Target

8cbad4f9825066815efdb99db8c696e0_NeikiAnalytics.exe
Size

724KB
MD5

8cbad4f9825066815efdb99db8c696e0
SHA1

4d8026f36a3e64ce775e15ddae07d922da44d157
SHA256

6646480917b24492ac7cedf3ab5fd59a53bae63a07d25dd119ebea9ce805b879
SHA512

839344cfd868e24375b984498026ba37cb6db81db5f9146e6a6b0184de3e7f19407af038ece578a0429877e751010480f792d522bb44477e192aa305887fd344
SSDEEP

12288:7B6jfu9W5qVnpA1P9mTx87m7HGA04OBGaSuQalOZeW0dfLX+pd167QhEQJ:167MnVnpA1lmTx8MmA07AaSuDSwdzE6o

Score

10^/10

FakeAV, RogueAntivirus
FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.
fakeav spyware fakeav

FakeAV payload 1 IoCs

fakeav spyware

Processes:

resource	yara_rule
behavioral1/memory/848-0-0x0000000000400000-0x00000000004C1000-memory.dmp	fakeav

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2320 848 WerFault.exe 8cbad4f9825066815efdb99db8c696e0_NeikiAnalytics.exe

pid	pid_target	process	target process
2320	848	WerFault.exe	8cbad4f9825066815efdb99db8c696e0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8cbad4f9825066815efdb99db8c696e0_NeikiAnalytics.exe

description	pid	process	target process
PID 848 wrote to memory of 2320	848	8cbad4f9825066815efdb99db8c696e0_NeikiAnalytics.exe	WerFault.exe
PID 848 wrote to memory of 2320	848	8cbad4f9825066815efdb99db8c696e0_NeikiAnalytics.exe	WerFault.exe
PID 848 wrote to memory of 2320	848	8cbad4f9825066815efdb99db8c696e0_NeikiAnalytics.exe	WerFault.exe
PID 848 wrote to memory of 2320	848	8cbad4f9825066815efdb99db8c696e0_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8cbad4f9825066815efdb99db8c696e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8cbad4f9825066815efdb99db8c696e0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 176
2⤵
- Program crash
PID:2320

memory/848-0-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download