33dc7bef522b9e55e068a78d5e291122406f0aa70e24192db26936ac70484ecd

Analysis

max time kernel
144s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 06:50

Target

b5829320cffe56eb271915396a0f07c0_NeikiAnalytics.exe
Size

190KB
MD5

b5829320cffe56eb271915396a0f07c0
SHA1

0853604136653d69e76cc0c5e4e05f9d622c0f47
SHA256

33dc7bef522b9e55e068a78d5e291122406f0aa70e24192db26936ac70484ecd
SHA512

08ce452a5da01ad8543f59e5d4b1bafd5c7fa99bf1574603a2fa35d36f8581db37e4c9e6c437f61512b1ae7da7d72270ae4fbddd75041cce0c348c352833f131
SSDEEP

3072:l+ne7D1FYMTshn9BwXRAOsKaJYAniRJReAaXzc7NjrTbuK7oH3TaRfjU/:jFYMTshnkX+OsKaJYAniR+Ar7N+Kk3T5

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1956	b5829320cffe56eb271915396a0f07c0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
1956	b5829320cffe56eb271915396a0f07c0_NeikiAnalytics.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1052	940	WerFault.exe	90
3848	1956	WerFault.exe	95
3108	1956	WerFault.exe	95

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
940	b5829320cffe56eb271915396a0f07c0_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1956	b5829320cffe56eb271915396a0f07c0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 1956	940	b5829320cffe56eb271915396a0f07c0_NeikiAnalytics.exe	95
PID 940 wrote to memory of 1956	940	b5829320cffe56eb271915396a0f07c0_NeikiAnalytics.exe	95
PID 940 wrote to memory of 1956	940	b5829320cffe56eb271915396a0f07c0_NeikiAnalytics.exe	95

C:\Users\Admin\AppData\Local\Temp\b5829320cffe56eb271915396a0f07c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b5829320cffe56eb271915396a0f07c0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 404
  2⤵
  - Program crash
  PID:1052
- C:\Users\Admin\AppData\Local\Temp\b5829320cffe56eb271915396a0f07c0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\b5829320cffe56eb271915396a0f07c0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 372
    3⤵
    - Program crash
    PID:3848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 408
    3⤵
    - Program crash
    PID:3108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 940 -ip 940
1⤵
PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1956 -ip 1956
1⤵
PID:1904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1400 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1956 -ip 1956
1⤵
PID:4672

C:\Users\Admin\AppData\Local\Temp\b5829320cffe56eb271915396a0f07c0_NeikiAnalytics.exe

Filesize
190KB

MD5
4094c12ee08e954e35e6fcce4ecab33b

SHA1
edc3f8e9e47b9dab7af2b195397cee312825301c

SHA256
c1f6a821c1501c29d82336eb492d99f6d70e4585f09f00f6644d4d9f23d26a51

SHA512
dc10e8cb8f9d6cba0d54318720ffc08355e4945121a25327794197ce77456cb878758630376a6dd62b3d1116d002d3cdd2aa4a48fc4e3ddc4232e25d5d969a7c

Download Submit
memory/940-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/940-1-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/940-8-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1956-9-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1956-10-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1956-15-0x0000000001510000-0x0000000001547000-memory.dmp

Filesize
220KB

Download