71913f4406474f1c89fd6dc25aa56c747bed809bd347e84ed205313e616136cb

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 15:36

Target

aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe
Size

690KB
MD5

aaaf561e6929980b5dd9263b940f55b0
SHA1

0ecf1efff41fa45aab2c794a025e0abf5e8b38fc
SHA256

71913f4406474f1c89fd6dc25aa56c747bed809bd347e84ed205313e616136cb
SHA512

bacd7dc349a2ec09c23b72808a9b2e4470e8b585f1d68339e94145b45707e495287501273eb715bacaca9875b2eda2a1c1ae9a47b4a490e086743b6568a6f454
SSDEEP

12288:edmH3hRCjQuv0IUttVMSX98r/LbfjI6tuIoSRBEbCZQqXNr:edmH36cY0IstVMSNC/Lb7I2uSROCvXNr

Score

5^/10

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/2356-0-0x0000000000400000-0x00000000004AE000-memory.dmp	autoit_exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2416 2356 WerFault.exe aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe

pid	pid_target	process	target process
2416	2356	WerFault.exe	aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe

description	pid	process	target process
PID 2356 wrote to memory of 2416	2356	aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe	WerFault.exe
PID 2356 wrote to memory of 2416	2356	aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe	WerFault.exe
PID 2356 wrote to memory of 2416	2356	aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe	WerFault.exe
PID 2356 wrote to memory of 2416	2356	aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\aaaf561e6929980b5dd9263b940f55b0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 204
2⤵
- Program crash
PID:2416

memory/2356-0-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download