2de584a70c271172e2e84bfe9ff212782881f9a9c16c493250537c34be4494d1

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 05:56

Target

73b1a48e46feb2a7befd741ec0ad7170_NeikiAnalytics.exe
Size

202KB
MD5

73b1a48e46feb2a7befd741ec0ad7170
SHA1

d9c58b77d8297650b859869c4bf5b562b95dbbd2
SHA256

2de584a70c271172e2e84bfe9ff212782881f9a9c16c493250537c34be4494d1
SHA512

975509fa87b6f2d71df334cd9775ad7e4e0e4d119d651f9e29c19d8306d9d50633fa24d9b1f062ae3f44af5b321734a59a0fb4acade7da3c2f8f1844c76f2e92
SSDEEP

3072:1DnQIhJ+P/ol0Vp26H37avbiwt6jilTNj0BLeiKLX/P8Gck5q4jVeHpio5O2y3y1:lQIagQx6AipNj0VBmX55q5QB26bCrP

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4732	73b1a48e46feb2a7befd741ec0ad7170_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4732	73b1a48e46feb2a7befd741ec0ad7170_NeikiAnalytics.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3276	1408	WerFault.exe	81
544	4732	WerFault.exe	89

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1408	73b1a48e46feb2a7befd741ec0ad7170_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4732	73b1a48e46feb2a7befd741ec0ad7170_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 4732	1408	73b1a48e46feb2a7befd741ec0ad7170_NeikiAnalytics.exe	89
PID 1408 wrote to memory of 4732	1408	73b1a48e46feb2a7befd741ec0ad7170_NeikiAnalytics.exe	89
PID 1408 wrote to memory of 4732	1408	73b1a48e46feb2a7befd741ec0ad7170_NeikiAnalytics.exe	89

C:\Users\Admin\AppData\Local\Temp\73b1a48e46feb2a7befd741ec0ad7170_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\73b1a48e46feb2a7befd741ec0ad7170_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 396
  2⤵
  - Program crash
  PID:3276
- C:\Users\Admin\AppData\Local\Temp\73b1a48e46feb2a7befd741ec0ad7170_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\73b1a48e46feb2a7befd741ec0ad7170_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 368
    3⤵
    - Program crash
    PID:544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1408 -ip 1408
1⤵
PID:2492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4732 -ip 4732
1⤵
PID:1480

C:\Users\Admin\AppData\Local\Temp\73b1a48e46feb2a7befd741ec0ad7170_NeikiAnalytics.exe

Filesize
202KB

MD5
802f21463aaddbbb9a0019e86ca599db

SHA1
9c5d2d9385d4f15d02851b65f719276a3537abd8

SHA256
521bf1ad8d2ea5ca6c574f2c75cd97c919a141529067678cbf402e4fd941c920

SHA512
95d554380e7d87c627d750e017a4f34ad54e1ab64ee5ee74d04c9445b0c682a9bfdfaddce5f223910cfdc247118828abccb8856aa1be8f788966109b89f72f1a

Download Submit
memory/1408-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1408-6-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4732-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4732-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4732-13-0x0000000001490000-0x00000000014CE000-memory.dmp

Filesize
248KB

Download
memory/4732-14-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download