145d2dd48ebd7e197eb9d30024e734f26e0ea05617a05b9e3850c2b6c3daee94

Analysis

max time kernel
132s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 19:32

Target

54bc472049f6a950812fe734f0e5fdb0_NeikiAnalytics.exe
Size

175KB
MD5

54bc472049f6a950812fe734f0e5fdb0
SHA1

dc0472a147d53d38a28b7f724d684bdcb5668360
SHA256

145d2dd48ebd7e197eb9d30024e734f26e0ea05617a05b9e3850c2b6c3daee94
SHA512

b7620ce37fc18f8aed6952c69cc3c50ec6714772141a7e484a8e5d50d413362c0b0163714ecfcfd752f551422bd42acdd841856400e249b5dbe14fce4aa3d6f0
SSDEEP

3072:jZaJulaAw4WGe1J95lGgaGEOWCKX2GAMMlG6TfndfbQqsxsrLwFKfu9locvsZdPZ:jZGucAw4WGebpGgNzGERTfnZQYLwM294

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1948	54bc472049f6a950812fe734f0e5fdb0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
1948	54bc472049f6a950812fe734f0e5fdb0_NeikiAnalytics.exe

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2152	1552	WerFault.exe	82
5068	1948	WerFault.exe	88
4108	1948	WerFault.exe	88
1120	1948	WerFault.exe	88
972	1948	WerFault.exe	88

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1552	54bc472049f6a950812fe734f0e5fdb0_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1948	54bc472049f6a950812fe734f0e5fdb0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1948	1552	54bc472049f6a950812fe734f0e5fdb0_NeikiAnalytics.exe	88
PID 1552 wrote to memory of 1948	1552	54bc472049f6a950812fe734f0e5fdb0_NeikiAnalytics.exe	88
PID 1552 wrote to memory of 1948	1552	54bc472049f6a950812fe734f0e5fdb0_NeikiAnalytics.exe	88

C:\Users\Admin\AppData\Local\Temp\54bc472049f6a950812fe734f0e5fdb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\54bc472049f6a950812fe734f0e5fdb0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 392
  2⤵
  - Program crash
  PID:2152
- C:\Users\Admin\AppData\Local\Temp\54bc472049f6a950812fe734f0e5fdb0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\54bc472049f6a950812fe734f0e5fdb0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 352
    3⤵
    - Program crash
    PID:5068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 768
    3⤵
    - Program crash
    PID:4108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 788
    3⤵
    - Program crash
    PID:1120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 772
    3⤵
    - Program crash
    PID:972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1552 -ip 1552
1⤵
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1948 -ip 1948
1⤵
PID:2952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1948 -ip 1948
1⤵
PID:4196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1948 -ip 1948
1⤵
PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1948 -ip 1948
1⤵
PID:2040

C:\Users\Admin\AppData\Local\Temp\54bc472049f6a950812fe734f0e5fdb0_NeikiAnalytics.exe

Filesize
175KB

MD5
36505c73c8aec6126a624b52b1be9f99

SHA1
ff617aef3cd8a62f4107628da83213ddb80bf53e

SHA256
a0c934d13e9920da106e1b46380a7ddb851a868620ef1cd2dd13f6ec5796b06a

SHA512
9c3327bb59551bfa0e2e3152335b219a6178b4658ec7ef2e0bd4bc66a8c1bc2aa3d200455476c58168b9b08dad7e5877860540435b46138887b3f6068c799b68

Download Submit
memory/1552-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1552-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1948-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1948-9-0x0000000004D60000-0x0000000004D93000-memory.dmp

Filesize
204KB

Download
memory/1948-10-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download