edcc99c3a1239f48d294120568afb0b1e41a35cf974c1cddb8b2fee6e3c1b462

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 09:43

Target

c1015a865ed79bf5a61b55349504cad0_NeikiAnalytics.exe
Size

384KB
MD5

c1015a865ed79bf5a61b55349504cad0
SHA1

11d30034a41d7ce6418ac9a1077a444471dc2dfb
SHA256

edcc99c3a1239f48d294120568afb0b1e41a35cf974c1cddb8b2fee6e3c1b462
SHA512

15bd97754ccf2da1f9caa0a29b7f282ba0141703d691d9d68d3475902d3072290797eeeeda563ac6fdff7f1b713f1d044a6ca37e517a7e336fa322a4be13a23b
SSDEEP

12288:ZK/f1p1Dz141/PV4UY7WFdsiAy0B6D9d9pAX:QFDzvgs

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1764	c1015a865ed79bf5a61b55349504cad0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
1764	c1015a865ed79bf5a61b55349504cad0_NeikiAnalytics.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
2648	4880	WerFault.exe	81
676	1764	WerFault.exe	88
3980	1764	WerFault.exe	88
1112	1764	WerFault.exe	88
2408	1764	WerFault.exe	88
1336	1764	WerFault.exe	88
2180	1764	WerFault.exe	88

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4880	c1015a865ed79bf5a61b55349504cad0_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1764	c1015a865ed79bf5a61b55349504cad0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 1764	4880	c1015a865ed79bf5a61b55349504cad0_NeikiAnalytics.exe	88
PID 4880 wrote to memory of 1764	4880	c1015a865ed79bf5a61b55349504cad0_NeikiAnalytics.exe	88
PID 4880 wrote to memory of 1764	4880	c1015a865ed79bf5a61b55349504cad0_NeikiAnalytics.exe	88

C:\Users\Admin\AppData\Local\Temp\c1015a865ed79bf5a61b55349504cad0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c1015a865ed79bf5a61b55349504cad0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 356
  2⤵
  - Program crash
  PID:2648
- C:\Users\Admin\AppData\Local\Temp\c1015a865ed79bf5a61b55349504cad0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\c1015a865ed79bf5a61b55349504cad0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 352
    3⤵
    - Program crash
    PID:676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 768
    3⤵
    - Program crash
    PID:3980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 808
    3⤵
    - Program crash
    PID:1112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 776
    3⤵
    - Program crash
    PID:2408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 816
    3⤵
    - Program crash
    PID:1336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 788
    3⤵
    - Program crash
    PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4880 -ip 4880
1⤵
PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1764 -ip 1764
1⤵
PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1764 -ip 1764
1⤵
PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1764 -ip 1764
1⤵
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1764 -ip 1764
1⤵
PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1764 -ip 1764
1⤵
PID:880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1764 -ip 1764
1⤵
PID:2520

C:\Users\Admin\AppData\Local\Temp\c1015a865ed79bf5a61b55349504cad0_NeikiAnalytics.exe

Filesize
384KB

MD5
a234355767028bc0487211414e68ac1e

SHA1
aee57dade2715529d59cbd04517eb073e429993f

SHA256
44ee22891be0e17bc0eb0cd032f7b575246f47f618525bceeedaa69ed6b99db7

SHA512
116c5fa1dc346743e7fbe5eb728936e54a3b5c46fcd950de903cb15adcb57e3740149c00ab8b31206a1f4895b5473e96bf537a336894c46b230698fe969e4acc

Download Submit
memory/1764-7-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1764-8-0x0000000000150000-0x0000000000186000-memory.dmp

Filesize
216KB

Download
memory/1764-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4880-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4880-6-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download