68836268c64512d1aa64049c1623c229fd5303764253600ff8dbdf7889686a49

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 13:29

Target

d4338531822d00d4f429fc0322771c90_NeikiAnalytics.exe
Size

1.3MB
MD5

d4338531822d00d4f429fc0322771c90
SHA1

3f5c55b51771732fe93f0f5d1963011f1507a499
SHA256

68836268c64512d1aa64049c1623c229fd5303764253600ff8dbdf7889686a49
SHA512

c2719c63c2a6886b778da6dc4d939497d0dbda5e613e2c1cbaf67baeee456215c4a15a62b9457ebffd42aab351bc87c50a02fae346c2ccf9d9f9b4b154949a7e
SSDEEP

12288:JBpJb3sRgf+9cTAhrj2TsqjVDa/ZSoPDm3Xx/MCtjW:rpJTs2bqf2Y4a/ZSoPDQ+ei

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4528	d4338531822d00d4f429fc0322771c90_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4528	d4338531822d00d4f429fc0322771c90_NeikiAnalytics.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
456	2072	WerFault.exe	81
3200	4528	WerFault.exe	90
1988	4528	WerFault.exe	90

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2072	d4338531822d00d4f429fc0322771c90_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4528	d4338531822d00d4f429fc0322771c90_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 4528	2072	d4338531822d00d4f429fc0322771c90_NeikiAnalytics.exe	90
PID 2072 wrote to memory of 4528	2072	d4338531822d00d4f429fc0322771c90_NeikiAnalytics.exe	90
PID 2072 wrote to memory of 4528	2072	d4338531822d00d4f429fc0322771c90_NeikiAnalytics.exe	90

C:\Users\Admin\AppData\Local\Temp\d4338531822d00d4f429fc0322771c90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d4338531822d00d4f429fc0322771c90_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 344
  2⤵
  - Program crash
  PID:456
- C:\Users\Admin\AppData\Local\Temp\d4338531822d00d4f429fc0322771c90_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\d4338531822d00d4f429fc0322771c90_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 348
    3⤵
    - Program crash
    PID:3200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 312
    3⤵
    - Program crash
    PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2072 -ip 2072
1⤵
PID:888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4528 -ip 4528
1⤵
PID:2272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4528 -ip 4528
1⤵
PID:1768

C:\Users\Admin\AppData\Local\Temp\d4338531822d00d4f429fc0322771c90_NeikiAnalytics.exe

Filesize
1.3MB

MD5
ac5ee22bb1dd990503a0492146972aa4

SHA1
1ba45d4fbceafa3bf306e1b74b1bf7aa658f626d

SHA256
2117176a636b09d5b9b47a683b187038364e5e2b3fcbf838a155b087d484c090

SHA512
1f1e7f7467c9a150538a577e5aef2ce6bcabe241714e15d9de0e069a08a3b08adb918fb00dedc0d2d95e31bf8a74b8038b1299814f8438ed3faf2d88084d61ee

Download Submit
memory/2072-0-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2072-6-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/4528-7-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/4528-8-0x0000000004FA0000-0x0000000005090000-memory.dmp

Filesize
960KB

Download
memory/4528-10-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download