246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538

Analysis

max time kernel
130s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 23:34

Target

246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe
Size

59KB
MD5

f93578bd6bebe2b5f8825db989cca1a0
SHA1

dd1f0779ad4af9a5847d3b55a94803bab73d8788
SHA256

246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538
SHA512

a6e9c65ea4d3056b988a43bbf125edc7e32172d5ded1a8c0ab3ee9ede4547f8d3e16ae70c42b40f04bea66a8a9cfc4b6ba04735192dab0a04ee43d9ae6131448
SSDEEP

768:HZgO6moL8ifXzCknHwgHbH84J7bPBLszy2Y/nnXvvJ1GS7jc0uWEJ8/r+j58GQ:5gODivrnHFvJ71aMfBR7LEJ8w5

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
3888	246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
3888	246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2120-0-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral2/files/0x0005000000022f58-11.dat	upx
behavioral2/memory/3888-13-0x0000000000400000-0x000000000043D000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2120	246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2120	246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe
3888	246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 3888	2120	246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe	86
PID 2120 wrote to memory of 3888	2120	246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe	86
PID 2120 wrote to memory of 3888	2120	246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe	86

C:\Users\Admin\AppData\Local\Temp\246bf2a185b172d9495de494750eda2fa6e85c0dd44def2fcae9473a5e53d538_NeikiAnalytics.exe

Filesize
59KB

MD5
a54d67a6f6f8a07d0905aefd386ab246

SHA1
a6e2b2fce4925fccf51fe78efc0fc245beb13621

SHA256
38c36f75c39964e9e186cedcd8a311aadcd054d858f385c0b2bcaeac55106317

SHA512
b1e150b4d8deffbb625f7f5600e0330ed42213c35474c267e6015e2ed8e4aa4a97496591ac01121a81be1779a17ad0d68f72443ceefb3f780ed6c4d5636f230f

Download Submit
memory/2120-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2120-1-0x00000000001B0000-0x00000000001BF000-memory.dmp

Filesize
60KB

Download
memory/2120-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2120-12-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3888-13-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3888-14-0x0000000000190000-0x000000000019F000-memory.dmp

Filesize
60KB

Download
memory/3888-16-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3888-20-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3888-25-0x0000000004D70000-0x0000000004D8D000-memory.dmp

Filesize
116KB

Download
memory/3888-26-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download