f419e15737941e40d44fb295e347a3b2cf2bf19f1e19bfbfb75bdb665410ef04

Analysis

max time kernel
135s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 22:03

Target

13aeaea72497fb3fb6e4ed5d0d5360e0_NeikiAnalytics.exe
Size

384KB
MD5

13aeaea72497fb3fb6e4ed5d0d5360e0
SHA1

61c2ca917ff2c7e3ae2975c8369b8c44d79157af
SHA256

f419e15737941e40d44fb295e347a3b2cf2bf19f1e19bfbfb75bdb665410ef04
SHA512

786b2d82083e1befa102b8caf86e52f9c159784a969e7734e23d4ab27bfbc9b6c91caf56236502f49897aef21863425aec678949a2d20be2b9e75f039100a1f4
SSDEEP

6144:TM18wTJpYkYCZ+c71v1BWBdPNXKPdWsZ20W7cyqCxSngmMBqfycuPbUl0i5cD5J:TM1lrYkrBWBdPJKPEgk0npM4dl0v5J

Score

7^/10

Deletes itself 1 IoCs

pid	Process
728	13aeaea72497fb3fb6e4ed5d0d5360e0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
728	13aeaea72497fb3fb6e4ed5d0d5360e0_NeikiAnalytics.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
4728	1112	WerFault.exe	83
1004	728	WerFault.exe	89
1292	728	WerFault.exe	89
2784	728	WerFault.exe	89
2572	728	WerFault.exe	89
908	728	WerFault.exe	89

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1112	13aeaea72497fb3fb6e4ed5d0d5360e0_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
728	13aeaea72497fb3fb6e4ed5d0d5360e0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 728	1112	13aeaea72497fb3fb6e4ed5d0d5360e0_NeikiAnalytics.exe	89
PID 1112 wrote to memory of 728	1112	13aeaea72497fb3fb6e4ed5d0d5360e0_NeikiAnalytics.exe	89
PID 1112 wrote to memory of 728	1112	13aeaea72497fb3fb6e4ed5d0d5360e0_NeikiAnalytics.exe	89

C:\Users\Admin\AppData\Local\Temp\13aeaea72497fb3fb6e4ed5d0d5360e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\13aeaea72497fb3fb6e4ed5d0d5360e0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 388
  2⤵
  - Program crash
  PID:4728
- C:\Users\Admin\AppData\Local\Temp\13aeaea72497fb3fb6e4ed5d0d5360e0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\13aeaea72497fb3fb6e4ed5d0d5360e0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 360
    3⤵
    - Program crash
    PID:1004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 768
    3⤵
    - Program crash
    PID:1292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 788
    3⤵
    - Program crash
    PID:2784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 776
    3⤵
    - Program crash
    PID:2572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 764
    3⤵
    - Program crash
    PID:908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1112 -ip 1112
1⤵
PID:2572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 728 -ip 728
1⤵
PID:2848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 728 -ip 728
1⤵
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 728 -ip 728
1⤵
PID:4128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 728 -ip 728
1⤵
PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 728 -ip 728
1⤵
PID:3844

C:\Users\Admin\AppData\Local\Temp\13aeaea72497fb3fb6e4ed5d0d5360e0_NeikiAnalytics.exe

Filesize
384KB

MD5
64e138d410f0bc25d3979257b7f7ee98

SHA1
367ee3d7e18db70d9633413f1c8dbcdf208755ed

SHA256
b06d54e40651dcb26a1687f78b51e572b7042ba37642722ae42d3a171e2be43a

SHA512
64ce4832414975f6f6c6b4875e695f25926dceda69a048828a12478b534a763287812a75e2fe231d47011bfe1eeeeab97fee79777f31adf9235178cbe91bde02

Download Submit
memory/728-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/728-8-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/728-13-0x00000000014B0000-0x00000000014EE000-memory.dmp

Filesize
248KB

Download
memory/1112-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1112-6-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download