1bd56a7fc8529a986b6276bd4eaafce486f4f70c78d8db73df642c84b2c3dc3c

Analysis

max time kernel
92s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 13:49

Target

c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe
Size

274KB
MD5

c919c9ef84f0b40869cc1bcf5d981fe0
SHA1

3c99b304f3030c99a71e7e785d52370d78ba428f
SHA256

1bd56a7fc8529a986b6276bd4eaafce486f4f70c78d8db73df642c84b2c3dc3c
SHA512

9316ae9fa6ab089f61900c1bce7e435b85b381b72ce66fed6e3f2dbedc5f2f12f31150f9893c7bbb0f30c783c51c7e2dbb142cf587010d1c367dba5334aefc0a
SSDEEP

6144:OULSmaOpn+0msBj1ud892ZXneB7FKNzYW0xfsLP:OUL9aO40msBjQd89U3eruufm

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3924	c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
3924	c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3620	1672	WerFault.exe	81
2320	3924	WerFault.exe	89
1508	3924	WerFault.exe	89

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1672	c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 3924	1672	c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe	89
PID 1672 wrote to memory of 3924	1672	c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe	89
PID 1672 wrote to memory of 3924	1672	c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe	89

C:\Users\Admin\AppData\Local\Temp\c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 400
  2⤵
  - Program crash
  PID:3620
- C:\Users\Admin\AppData\Local\Temp\c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 368
    3⤵
    - Program crash
    PID:2320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 164
    3⤵
    - Program crash
    PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1672 -ip 1672
1⤵
PID:2992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3924 -ip 3924
1⤵
PID:2888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3924 -ip 3924
1⤵
PID:2792

C:\Users\Admin\AppData\Local\Temp\c919c9ef84f0b40869cc1bcf5d981fe0_NeikiAnalytics.exe

Filesize
274KB

MD5
fa6b4b4c79c9275bc7244e9d88d84eb8

SHA1
45b1ab5475f67c39edcfdff69bc9ebd3baebee8b

SHA256
6994b8a199a0fd927794eeef7ced3ca051626348641c9a7b6ae90468a72cc686

SHA512
5ec215391041b11277351c8aa9d72266939c74d5d0450770a52367303762529f73a36e876e2687797ef09c9328e6dbc22c7b50792c1edecf511bab309d837719

Download Submit
memory/1672-0-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1672-7-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3924-8-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3924-10-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download