0cd59a6895540794a339b2f8af9ad2d43913989c6489c3835e6187c26e77d1e6

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 11:36

Target

a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe
Size

1.0MB
MD5

a20aa75ae65fde9d6c346e54107caff0
SHA1

395d2493240c7c066f85ef3e63fc367d69ec1573
SHA256

0cd59a6895540794a339b2f8af9ad2d43913989c6489c3835e6187c26e77d1e6
SHA512

661f9d6dbcac29fe4124ac69141d4295256ea87e890b0851bc171c292d25c394a65d839f8bb17dc34d9ac8d4d921a5166cbb397713ed41018221177829355b3f
SSDEEP

12288:DNHbKFvpdgFW39cq5AjehJAHm6IjVDaPZSVTzH3hf8Ctzu:ZHKpdgFiaQJXaPZSVTb+eK

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3052	a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
3052	a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe

Loads dropped DLL 4 IoCs

pid	Process
3032	a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe
2488	WerFault.exe
2488	WerFault.exe
2488	WerFault.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2488	3052	WerFault.exe	29

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3032	a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3052	a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 3052	3032	a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe	29
PID 3032 wrote to memory of 3052	3032	a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe	29
PID 3032 wrote to memory of 3052	3032	a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe	29
PID 3032 wrote to memory of 3052	3032	a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe	29
PID 3052 wrote to memory of 2488	3052	a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe	30
PID 3052 wrote to memory of 2488	3052	a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe	30
PID 3052 wrote to memory of 2488	3052	a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe	30
PID 3052 wrote to memory of 2488	3052	a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe	30

\Users\Admin\AppData\Local\Temp\a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe

Filesize
1.0MB

MD5
4e6fdefffa1caae738bcb8c78f00d33b

SHA1
b52bc1531105902c222be23fc40a9bc1302d448e

SHA256
c812a1805868f69d768767040c8026bf4071f5372dcaf6790342f42554264157

SHA512
982d87273d01e1c51a73ed6c3a3f72fc149a25d4da5b022bbb8e9dc0c7c72ac29055e5458f6d84325e21737c8082fc3654a7e45db345c58237ad3a5be81ec65f

Download Submit
memory/3032-0-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/3032-7-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/3052-9-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/3052-10-0x0000000002E20000-0x0000000002F0C000-memory.dmp

Filesize
944KB

Download