edfa90b9dbabb747cacafee9e20a62f2516d14dbf2411a67efe73ff0d787661d

Analysis

max time kernel
130s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 13:13

Target

b99384011a78763aefc058d38beec290_NeikiAnalytics.exe
Size

960KB
MD5

b99384011a78763aefc058d38beec290
SHA1

b925d22fbb35be935495f25cbc500c905165daa8
SHA256

edfa90b9dbabb747cacafee9e20a62f2516d14dbf2411a67efe73ff0d787661d
SHA512

6fd9dcbdb2b7b96af9e97c6af49d60b958235ac147a0c1a36be907ff57919fb154b5e16c5d0584f045b201b72278b348a970bfa4153466594c29dc4d5f57fa41
SSDEEP

12288:tAIJaUwn/NAzQUpvrHjVDa/ZS4fD2Hnh6:tA6av/uzQ0vrFa/ZS4fDw8

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4764	b99384011a78763aefc058d38beec290_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4764	b99384011a78763aefc058d38beec290_NeikiAnalytics.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1436	2100	WerFault.exe	82
4152	4764	WerFault.exe	89
4972	4764	WerFault.exe	89

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2100	b99384011a78763aefc058d38beec290_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4764	b99384011a78763aefc058d38beec290_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 4764	2100	b99384011a78763aefc058d38beec290_NeikiAnalytics.exe	89
PID 2100 wrote to memory of 4764	2100	b99384011a78763aefc058d38beec290_NeikiAnalytics.exe	89
PID 2100 wrote to memory of 4764	2100	b99384011a78763aefc058d38beec290_NeikiAnalytics.exe	89

C:\Users\Admin\AppData\Local\Temp\b99384011a78763aefc058d38beec290_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b99384011a78763aefc058d38beec290_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 344
  2⤵
  - Program crash
  PID:1436
- C:\Users\Admin\AppData\Local\Temp\b99384011a78763aefc058d38beec290_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\b99384011a78763aefc058d38beec290_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 352
    3⤵
    - Program crash
    PID:4152
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 376
    3⤵
    - Program crash
    PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2100 -ip 2100
1⤵
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4764 -ip 4764
1⤵
PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4764 -ip 4764
1⤵
PID:432

C:\Users\Admin\AppData\Local\Temp\b99384011a78763aefc058d38beec290_NeikiAnalytics.exe

Filesize
960KB

MD5
28c24c7bb57350412077eab8a6f66a6d

SHA1
ca01e9edf6f0514c1a1e499ed20951bfb6b4f5e8

SHA256
6b6d5ae638331e3fac96d04267fd5ffe3738a1dfb047e392cd5d3424dc79a857

SHA512
e0919aa2f9830bced1eb603c5645765de8de93dc0ac816bfcde1eb6c9bf931e328481168f811e3f2b6c88082ac856476c39ee85fe0c0865a4d9517d54e0a8e3d

Download Submit
memory/2100-0-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2100-6-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/4764-7-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/4764-8-0x0000000005050000-0x0000000005140000-memory.dmp

Filesize
960KB

Download
memory/4764-9-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download