61375189323e114214b7ca63fd80873460bac59ca432ff44f2114b4c0badae19

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 00:38

Target

264510ea0624c4d69f73d822af687430_NeikiAnalytics.exe
Size

653KB
MD5

264510ea0624c4d69f73d822af687430
SHA1

30e8f7c31c9991f68f356e42932da6523d5ff277
SHA256

61375189323e114214b7ca63fd80873460bac59ca432ff44f2114b4c0badae19
SHA512

5525a3709c4c3e9b037e0cca3e052489d6f2e175dfe4f620110b1d4493d82912a1f5067acd15bdc7ecdaabc87e8dba832fc190e5c118ce62ca5a7c0e5bec803c
SSDEEP

12288:Q3ggq6MaimNk28Rz17yJRJLyt2BDyE7TNW9yyfA5KW7/il+MRjWAehRk+s:j7vmp8Rz1GJR8AB+Is9yvr7/jkV

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1724-0-0x000000013F080000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/1724-2-0x000000013F080000-0x000000013F4A2000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2992	1724	264510ea0624c4d69f73d822af687430_NeikiAnalytics.exe	29
PID 1724 wrote to memory of 2992	1724	264510ea0624c4d69f73d822af687430_NeikiAnalytics.exe	29
PID 1724 wrote to memory of 2992	1724	264510ea0624c4d69f73d822af687430_NeikiAnalytics.exe	29

C:\Users\Admin\AppData\Local\Temp\264510ea0624c4d69f73d822af687430_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\264510ea0624c4d69f73d822af687430_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1724 -s 84
  2⤵
  PID:2992

memory/1724-0-0x000000013F080000-0x000000013F4A2000-memory.dmp

Filesize
4.1MB

Download
memory/1724-1-0x00000000000F0000-0x0000000000110000-memory.dmp

Filesize
128KB

Download
memory/1724-2-0x000000013F080000-0x000000013F4A2000-memory.dmp

Filesize
4.1MB

Download