7de7a6cd14e1ff25db4d9c4407c52d3a87ed8fd7ad0260cbe5c198595a9e72f7

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 03:25

Target

6c1757a93fdbfe7db3c6070db71fbb00_NeikiAnalytics.exe
Size

213KB
MD5

6c1757a93fdbfe7db3c6070db71fbb00
SHA1

5e2d8bc237b014863b4af4cba05adb8797cdf5c9
SHA256

7de7a6cd14e1ff25db4d9c4407c52d3a87ed8fd7ad0260cbe5c198595a9e72f7
SHA512

d75f0d61fb36529f5608d7e3aaafdbd78f0186bc3868e7c6803b2ba64d6912a6206f97033ff57e602f3f76567f2b7bc107dc3c6042c3e4fff5890b35d04f031b
SSDEEP

6144:jjm/aXSq3vnP6nVAn++Y5owG1QtKFZwsLt+GECuFNTgS7tDH0:jCYvnP6nin+viJatAjVE9FlJDH0

Score

7^/10

Deletes itself 1 IoCs

pid	Process
572	6c1757a93fdbfe7db3c6070db71fbb00_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
572	6c1757a93fdbfe7db3c6070db71fbb00_NeikiAnalytics.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
412	4200	WerFault.exe	81
2832	572	WerFault.exe	89

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4200	6c1757a93fdbfe7db3c6070db71fbb00_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
572	6c1757a93fdbfe7db3c6070db71fbb00_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 572	4200	6c1757a93fdbfe7db3c6070db71fbb00_NeikiAnalytics.exe	89
PID 4200 wrote to memory of 572	4200	6c1757a93fdbfe7db3c6070db71fbb00_NeikiAnalytics.exe	89
PID 4200 wrote to memory of 572	4200	6c1757a93fdbfe7db3c6070db71fbb00_NeikiAnalytics.exe	89

C:\Users\Admin\AppData\Local\Temp\6c1757a93fdbfe7db3c6070db71fbb00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6c1757a93fdbfe7db3c6070db71fbb00_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 396
  2⤵
  - Program crash
  PID:412
- C:\Users\Admin\AppData\Local\Temp\6c1757a93fdbfe7db3c6070db71fbb00_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\6c1757a93fdbfe7db3c6070db71fbb00_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 364
    3⤵
    - Program crash
    PID:2832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4200 -ip 4200
1⤵
PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 572 -ip 572
1⤵
PID:1628

C:\Users\Admin\AppData\Local\Temp\6c1757a93fdbfe7db3c6070db71fbb00_NeikiAnalytics.exe

Filesize
213KB

MD5
3a0e7ac3495e7ff9f75b6b9fbc277031

SHA1
3d6ec43b6a9180b9054c7d2c024ef5796dd9d5dd

SHA256
c0d15f2fc02323c01cb75ef1767e7947ad3f0f743666684cf294bcf0ef0e254c

SHA512
3371b25394ba166500efc4227d190611d237c6c240596ed4e94069f67f840b5dd84b97898a5c7f87b978615cfabf4dda4ae156596579d37b6a4c199a319b6e7b

Download Submit
memory/572-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/572-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/572-13-0x0000000004DA0000-0x0000000004DE1000-memory.dmp

Filesize
260KB

Download
memory/4200-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4200-6-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download