61fa5d2d3dee4c2cdbfbc479f2dbb3a4a62ec08ac8c6bc52eb9b6995549f6451

Analysis

max time kernel
129s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 02:30

Target

5baf3eb3aebd59ce55b522ca962c5660_NeikiAnalytics.exe
Size

1.4MB
MD5

5baf3eb3aebd59ce55b522ca962c5660
SHA1

bbf175e624155c1b4a314463628a4621b4e9fba9
SHA256

61fa5d2d3dee4c2cdbfbc479f2dbb3a4a62ec08ac8c6bc52eb9b6995549f6451
SHA512

dfe0f23c51df7783f651e2274743ac7265bca4ac982de2ec7f5ff8564d62157f0adbc09d32d7620a526d975949b4e929ae8a5d2b6725c0dc7e9b8011ededd4f6
SSDEEP

24576:B2pyIAEnltauATTzE6KNDTrxa/ZS/QERT77Lv+f6T8TxL5qgAfTL7:sWuATeTtggQERTbExL5ID

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1228	5baf3eb3aebd59ce55b522ca962c5660_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
1228	5baf3eb3aebd59ce55b522ca962c5660_NeikiAnalytics.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3392	4204	WerFault.exe	82
4280	1228	WerFault.exe	90
3516	1228	WerFault.exe	90

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4204	5baf3eb3aebd59ce55b522ca962c5660_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 1228	4204	5baf3eb3aebd59ce55b522ca962c5660_NeikiAnalytics.exe	90
PID 4204 wrote to memory of 1228	4204	5baf3eb3aebd59ce55b522ca962c5660_NeikiAnalytics.exe	90
PID 4204 wrote to memory of 1228	4204	5baf3eb3aebd59ce55b522ca962c5660_NeikiAnalytics.exe	90

C:\Users\Admin\AppData\Local\Temp\5baf3eb3aebd59ce55b522ca962c5660_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5baf3eb3aebd59ce55b522ca962c5660_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 344
  2⤵
  - Program crash
  PID:3392
- C:\Users\Admin\AppData\Local\Temp\5baf3eb3aebd59ce55b522ca962c5660_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\5baf3eb3aebd59ce55b522ca962c5660_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 352
    3⤵
    - Program crash
    PID:4280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 164
    3⤵
    - Program crash
    PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4204 -ip 4204
1⤵
PID:2416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1228 -ip 1228
1⤵
PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1228 -ip 1228
1⤵
PID:3372

C:\Users\Admin\AppData\Local\Temp\5baf3eb3aebd59ce55b522ca962c5660_NeikiAnalytics.exe

Filesize
1.4MB

MD5
a45abedf831713f453e506b88bc4ff61

SHA1
616479f18ee00253bd131c06a895b2357ee2dcdc

SHA256
94aa512ad4504464a308856df461cda99ee8b3fa20779f4c34618dcc01fb66d3

SHA512
f6e3f07e47cb5000a4f2bf71593dd106aab30b3f58198332d70bb1ea79c14f286f82cb195450d21d35f87a441ce9dd2b61dd53543f371f375d5c45a377f0909d

Download Submit
memory/1228-6-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/1228-8-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/4204-0-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/4204-7-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download