6f53626f4f486caae077e84c569c976296b8ef155d4ad1f8de159eeb8041f1eb

Analysis

max time kernel
125s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 06:09

Target

89d738c5f904942b008daf6783bfa280_NeikiAnalytics.exe
Size

401KB
MD5

89d738c5f904942b008daf6783bfa280
SHA1

6416eaaf34701430c7d1d273f1ada7abc6f82b7c
SHA256

6f53626f4f486caae077e84c569c976296b8ef155d4ad1f8de159eeb8041f1eb
SHA512

3e5f99812b626b0475697302700907232754d99d66c95bc1303aa6ca1c983355826fbb0febb57d5f36b900cb7520af376337a9e706e7b57502146e73f8d468eb
SSDEEP

6144:/EmMAEw1ALxOUnYSwjrcGGQqu0BOOPO0MzxmlkTaVMzxmlkTanJlnvewRwMzxml:zl1YxOHSw07fu0jW0MAMU9RwM

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3900	89d738c5f904942b008daf6783bfa280_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
3900	89d738c5f904942b008daf6783bfa280_NeikiAnalytics.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1380	2356	WerFault.exe	89
2288	3900	WerFault.exe	97
3008	3900	WerFault.exe	97

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2356	89d738c5f904942b008daf6783bfa280_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 3900	2356	89d738c5f904942b008daf6783bfa280_NeikiAnalytics.exe	97
PID 2356 wrote to memory of 3900	2356	89d738c5f904942b008daf6783bfa280_NeikiAnalytics.exe	97
PID 2356 wrote to memory of 3900	2356	89d738c5f904942b008daf6783bfa280_NeikiAnalytics.exe	97

C:\Users\Admin\AppData\Local\Temp\89d738c5f904942b008daf6783bfa280_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\89d738c5f904942b008daf6783bfa280_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 396
  2⤵
  - Program crash
  PID:1380
- C:\Users\Admin\AppData\Local\Temp\89d738c5f904942b008daf6783bfa280_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\89d738c5f904942b008daf6783bfa280_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 372
    3⤵
    - Program crash
    PID:2288
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 172
    3⤵
    - Program crash
    PID:3008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2356 -ip 2356
1⤵
PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3900 -ip 3900
1⤵
PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3900 -ip 3900
1⤵
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4104,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
1⤵
PID:956

C:\Users\Admin\AppData\Local\Temp\89d738c5f904942b008daf6783bfa280_NeikiAnalytics.exe

Filesize
401KB

MD5
8a7799fbd17f139b63ba376d601352b6

SHA1
dffabdda8472db51bd0e95e6560014edea7ccf5d

SHA256
73050e6a944262597b5c6b6634abda91c8167e2d2cec1d55bcea002f50dcd901

SHA512
3aa558525f6e5427ed77897b4e9db607afb380348e757b580e9317675d468a66462484ccc18cf08dcef2648cb189f87a976f4cd42cb7319b607a347012272e54

Download Submit
memory/2356-0-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2356-8-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3900-7-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3900-10-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download