629e4c7858715a8dd7c634200a040724e954af0cb87346b8b4371579f28a49c1

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 16:47

Target

25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe
Size

1.1MB
MD5

25b3966cb262f3aeef5ea0a8f3ceccf0
SHA1

122763c7cb72d7c5638ac74bfeb4f4b7515691be
SHA256

629e4c7858715a8dd7c634200a040724e954af0cb87346b8b4371579f28a49c1
SHA512

298002e7f0badc8582a0d28f48cd2162c1c54ad68dd602e089de0978691aa8b0223d0986f51865c522975f4cfbc1b79118be89bd045680f03b18268dfab48711
SSDEEP

12288:ed3CkVCRdEo0aQi2Vj7LHflPjVDa/ZSBHnhvMCtjW:ONVUd31Bij7LHfl9a/ZSFueC

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1944	25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
1944	25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4504	3320	WerFault.exe	81
2064	1944	WerFault.exe	90
4564	1944	WerFault.exe	90

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3320	25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1944	25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 1944	3320	25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe	90
PID 3320 wrote to memory of 1944	3320	25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe	90
PID 3320 wrote to memory of 1944	3320	25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe	90

C:\Users\Admin\AppData\Local\Temp\25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 344
  2⤵
  - Program crash
  PID:4504
- C:\Users\Admin\AppData\Local\Temp\25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 344
    3⤵
    - Program crash
    PID:2064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 376
    3⤵
    - Program crash
    PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3320 -ip 3320
1⤵
PID:4676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1944 -ip 1944
1⤵
PID:2836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1944 -ip 1944
1⤵
PID:3164

C:\Users\Admin\AppData\Local\Temp\25b3966cb262f3aeef5ea0a8f3ceccf0_NeikiAnalytics.exe

Filesize
1.1MB

MD5
fa646ef096474de61fe9b7b62235e1b1

SHA1
a716c57ee72f1e7e0974f4d25e408c3442a5ad50

SHA256
18b6f0d342cf738942cb72e44b1c08b648cb9ed304d6fac6070b2590fdb4911d

SHA512
2ef289266ba5654e5cff7273173d7481f49e069cbb372ffe7aa1744e3c51d7581b267431e0e9c982698f8ddaea2b253cdefe5eb892cf40bec7f6bd485993eb06

Download Submit
memory/1944-7-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/1944-8-0x0000000004FE0000-0x00000000050CD000-memory.dmp

Filesize
948KB

Download
memory/1944-10-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/3320-0-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/3320-6-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download