54208fdc010231fe04046022fcd404d609d816aeecd55e09c8e28569a996eda8

Analysis

max time kernel
138s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 16:26

Target

8aa6252ad3c49e8f8271909ced627da0_NeikiAnalytics.exe
Size

448KB
MD5

8aa6252ad3c49e8f8271909ced627da0
SHA1

5481725f564a7cd485159e019e4bbf1a0a3e326d
SHA256

54208fdc010231fe04046022fcd404d609d816aeecd55e09c8e28569a996eda8
SHA512

9b60b4fdd68b92f24d30991304ca3092b23050fe5053693da3e3da439a5f4943dbccbddd8603b04f97c7d11ccbf14bcb190edce3215f06c8b8082ca4d2c5c585
SSDEEP

12288:ZQMtPsN07ckpHV7TCxft26OYuZuCIMukW2ckKWhVQ5zCD4TyWN4:ZNxfckj286OYuZuCIMukW2ckKWhVQ5zY

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4524	8aa6252ad3c49e8f8271909ced627da0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4524	8aa6252ad3c49e8f8271909ced627da0_NeikiAnalytics.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1372	976	WerFault.exe	82
3888	4524	WerFault.exe	89

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
976	8aa6252ad3c49e8f8271909ced627da0_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4524	8aa6252ad3c49e8f8271909ced627da0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 4524	976	8aa6252ad3c49e8f8271909ced627da0_NeikiAnalytics.exe	89
PID 976 wrote to memory of 4524	976	8aa6252ad3c49e8f8271909ced627da0_NeikiAnalytics.exe	89
PID 976 wrote to memory of 4524	976	8aa6252ad3c49e8f8271909ced627da0_NeikiAnalytics.exe	89

C:\Users\Admin\AppData\Local\Temp\8aa6252ad3c49e8f8271909ced627da0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8aa6252ad3c49e8f8271909ced627da0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 396
  2⤵
  - Program crash
  PID:1372
- C:\Users\Admin\AppData\Local\Temp\8aa6252ad3c49e8f8271909ced627da0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\8aa6252ad3c49e8f8271909ced627da0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 364
    3⤵
    - Program crash
    PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 976 -ip 976
1⤵
PID:3880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4524 -ip 4524
1⤵
PID:4980

C:\Users\Admin\AppData\Local\Temp\8aa6252ad3c49e8f8271909ced627da0_NeikiAnalytics.exe

Filesize
448KB

MD5
6ecc4b96c33c239f072ad380c5f5975c

SHA1
148deb3918c092c1f9ee550943eca2f38970b4a1

SHA256
499487eecaeac84ae820e20310bcb929320eff1e7b6fe11fc14f6196adc76072

SHA512
d4c658ebee51ebad9090409533d1847cd2e3c6afd1745824f26d837ebeb4b30fa1c31ca19d08c233d327cebdfb74f1401a32a1bf8c3d313fdf37b287a86f414d

Download Submit
memory/976-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/976-6-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4524-7-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/4524-13-0x0000000000190000-0x00000000001D6000-memory.dmp

Filesize
280KB

Download
memory/4524-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4524-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download