f4b4da62093a52c4f08b55c496e318e3f93bfad94543f62c314e080f3adce732

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 13:38

Target

4a5912fbe47c480970424e1263dfe570_NeikiAnalytics.exe
Size

3.8MB
MD5

4a5912fbe47c480970424e1263dfe570
SHA1

76f7373cb084b6fbf0c368b9b75a56d07ae62d4b
SHA256

f4b4da62093a52c4f08b55c496e318e3f93bfad94543f62c314e080f3adce732
SHA512

a96a99d9e10439b1c7645df5a7fd9526ff1df9cff9ac5bd8992ef05757436c4901f402efbb2f9d9b7ebd455ba10996ba4ceff1cd4cfa4e9e42dbcd3c1a8103be
SSDEEP

98304:YbA8IVdkKhL8Z57fyLB/K0P7eKiG1AYzQPqRA:Y2wcL87GLE0DeB3BPiA

Score

7^/10

themida

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
behavioral2/memory/2532-6-0x00000000006B0000-0x0000000000FB0000-memory.dmp	themida

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2328	2532	WerFault.exe	87

C:\Users\Admin\AppData\Local\Temp\4a5912fbe47c480970424e1263dfe570_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4a5912fbe47c480970424e1263dfe570_NeikiAnalytics.exe"
1⤵
PID:2532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 780
  2⤵
  - Program crash
  PID:2328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4196,i,16488180140590516186,11762960689811837350,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:8
1⤵
PID:4172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2532 -ip 2532
1⤵
PID:4340

memory/2532-0-0x00000000006B0000-0x0000000000FB0000-memory.dmp

Filesize
9.0MB

Download
memory/2532-1-0x00000000752C0000-0x00000000752C1000-memory.dmp

Filesize
4KB

Download
memory/2532-2-0x00000000752A0000-0x0000000075390000-memory.dmp

Filesize
960KB

Download
memory/2532-3-0x00000000752A0000-0x0000000075390000-memory.dmp

Filesize
960KB

Download
memory/2532-4-0x00000000752A0000-0x0000000075390000-memory.dmp

Filesize
960KB

Download
memory/2532-6-0x00000000006B0000-0x0000000000FB0000-memory.dmp

Filesize
9.0MB

Download
memory/2532-7-0x00000000752A0000-0x0000000075390000-memory.dmp

Filesize
960KB

Download