ea224b61a9cf3a34882c35d97cc2f64aed3d0cbb30c5706c49c9022c6cd44024 | Triage

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1d11e2a6939573d47bd13a791e6c29b0_NeikiAnalytics.exe
Size

16KB
MD5

1d11e2a6939573d47bd13a791e6c29b0
SHA1

3af85938405eb331ff3f629cc55f2de8d989223c
SHA256

ea224b61a9cf3a34882c35d97cc2f64aed3d0cbb30c5706c49c9022c6cd44024
SHA512

d378461326969a942e15941cb80f0810e0b19ff907c1833178e828fe563a9e5d3a524d07c072e3ea55486869c85f2017b39700bb97cec2721c854429c214e437
SSDEEP

384:oRV5kOXJ/tZsGl79NxtRVznKrH9DzL3Mf:E5RzbtRsHFL+

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2528	2156	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2156	1d11e2a6939573d47bd13a791e6c29b0_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2156	1d11e2a6939573d47bd13a791e6c29b0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2528	2156	1d11e2a6939573d47bd13a791e6c29b0_NeikiAnalytics.exe	29
PID 2156 wrote to memory of 2528	2156	1d11e2a6939573d47bd13a791e6c29b0_NeikiAnalytics.exe	29
PID 2156 wrote to memory of 2528	2156	1d11e2a6939573d47bd13a791e6c29b0_NeikiAnalytics.exe	29
PID 2156 wrote to memory of 2528	2156	1d11e2a6939573d47bd13a791e6c29b0_NeikiAnalytics.exe	29

C:\Users\Admin\AppData\Local\Temp\1d11e2a6939573d47bd13a791e6c29b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1d11e2a6939573d47bd13a791e6c29b0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 680
  2⤵
  - Program crash
  PID:2528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2156-0-0x000000007469E000-0x000000007469F000-memory.dmp

Filesize
4KB

Download
memory/2156-1-0x0000000000C20000-0x0000000000C2A000-memory.dmp

Filesize
40KB

Download
memory/2156-2-0x000000007469E000-0x000000007469F000-memory.dmp

Filesize
4KB

Download