d6ac803ad603694b16baa2c0215b9e1916f5cc18c59703d3a95ae2dfa0f7c8e5

Analysis

max time kernel
140s
max time network
129s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08/06/2024, 21:35

Target

00fb9661f35e617d43b6f967b824c9c0_NeikiAnalytics.exe
Size

653KB
MD5

00fb9661f35e617d43b6f967b824c9c0
SHA1

5044c267b1bc0dbdf378fc0f6e0c4e77b95caf7f
SHA256

d6ac803ad603694b16baa2c0215b9e1916f5cc18c59703d3a95ae2dfa0f7c8e5
SHA512

a72a493d0f0a838a90230a81609685d17a222472203a7b99843581601b887321618e382291d3babb166c7bdbe5fd702341f5a8f9c40d3b690c90500bed65592c
SSDEEP

12288:Q3ggq6MaimNk28Rz17yJRJLyt2BDyE7TNW9yyfA5KW7/il+MRjWAehRk+6:j7vmp8Rz1GJR8AB+Is9yvr7/jkD

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2360-1-0x000000013F280000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/2360-2-0x000000013F280000-0x000000013F6A2000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2944	2360	00fb9661f35e617d43b6f967b824c9c0_NeikiAnalytics.exe	29
PID 2360 wrote to memory of 2944	2360	00fb9661f35e617d43b6f967b824c9c0_NeikiAnalytics.exe	29
PID 2360 wrote to memory of 2944	2360	00fb9661f35e617d43b6f967b824c9c0_NeikiAnalytics.exe	29

C:\Users\Admin\AppData\Local\Temp\00fb9661f35e617d43b6f967b824c9c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\00fb9661f35e617d43b6f967b824c9c0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2360 -s 84
  2⤵
  PID:2944

memory/2360-1-0x000000013F280000-0x000000013F6A2000-memory.dmp

Filesize
4.1MB

Download
memory/2360-0-0x00000000000F0000-0x0000000000110000-memory.dmp

Filesize
128KB

Download
memory/2360-2-0x000000013F280000-0x000000013F6A2000-memory.dmp

Filesize
4.1MB

Download