d8d409a8d020ea7f8d8d515aae38542a4995217f799ecbf7f3606dfee25ede11

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 06:27

Target

8f61db31c18507290290fe903d867e60_NeikiAnalytics.exe
Size

223KB
MD5

8f61db31c18507290290fe903d867e60
SHA1

7194200e1bfae632d7f89b46ea734135506a7579
SHA256

d8d409a8d020ea7f8d8d515aae38542a4995217f799ecbf7f3606dfee25ede11
SHA512

3d9c756c7c125cb279569dacb426ecc7495c45faf20e0f1799288b839dac194b35ca8f2b71c779d3001b25d2e5dbec1afe6b7ccc3a956688679e45e3110c5ee8
SSDEEP

6144:u5GgJgBhFk801VcNliLcKQ8tqHz3I/COWP:IGtu1VK8LcJ8tqHz+COWP

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2412	8f61db31c18507290290fe903d867e60_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2412	8f61db31c18507290290fe903d867e60_NeikiAnalytics.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3668	1504	WerFault.exe	80
3776	2412	WerFault.exe	88

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1504	8f61db31c18507290290fe903d867e60_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2412	8f61db31c18507290290fe903d867e60_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 2412	1504	8f61db31c18507290290fe903d867e60_NeikiAnalytics.exe	88
PID 1504 wrote to memory of 2412	1504	8f61db31c18507290290fe903d867e60_NeikiAnalytics.exe	88
PID 1504 wrote to memory of 2412	1504	8f61db31c18507290290fe903d867e60_NeikiAnalytics.exe	88

C:\Users\Admin\AppData\Local\Temp\8f61db31c18507290290fe903d867e60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8f61db31c18507290290fe903d867e60_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 396
  2⤵
  - Program crash
  PID:3668
- C:\Users\Admin\AppData\Local\Temp\8f61db31c18507290290fe903d867e60_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\8f61db31c18507290290fe903d867e60_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 368
    3⤵
    - Program crash
    PID:3776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1504 -ip 1504
1⤵
PID:1168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2412 -ip 2412
1⤵
PID:1308

C:\Users\Admin\AppData\Local\Temp\8f61db31c18507290290fe903d867e60_NeikiAnalytics.exe

Filesize
223KB

MD5
fa48bafa62edda5292f7d2840ddca07b

SHA1
e6312281e8eb10af8664b4213ee60467f29b2eea

SHA256
213478928b6b8683c06c75a7c100c5a44fc2d178c05fa66aa5027cd3f583a325

SHA512
7e496841713a16f7bc928d9f8249cf522263e311a7af3ed6d8d9d5a284088a54b48cf63cd4db05b1109417273c6470f10072c0269fa4ee3225bf41c0e51b95e7

Download Submit
memory/1504-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1504-6-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2412-7-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2412-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2412-13-0x0000000001560000-0x00000000015A6000-memory.dmp

Filesize
280KB

Download
memory/2412-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download