31774443c56fb79367a50b25b822e0426e90ddd2143f272b156bd173c11429b4

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 19:00

Target

165787fb4d229ea6e0f82590e48c77b0_NeikiAnalytics.exe
Size

203KB
MD5

165787fb4d229ea6e0f82590e48c77b0
SHA1

8ad128e893bd82b36c5df9644645e39e5ec27e27
SHA256

31774443c56fb79367a50b25b822e0426e90ddd2143f272b156bd173c11429b4
SHA512

fe353b25e1fb6b79343c0fc16c936a734f40cbd0b340b99091181e88164cbaa67f533e62d77bf6b943e1079fe033dc5094daab726e18535d21f7d6e1a9762cb1
SSDEEP

3072:nA9pKbOfsyzImo0wYz0Un/yfBNe/ZHl52qqNoXf6+1hyeYs/4lEJGMsget:nupKaEyzIR0wYravE5ZqNay+1pYsvsZ

Score

7^/10

Deletes itself 1 IoCs

pid	Process
456	165787fb4d229ea6e0f82590e48c77b0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
456	165787fb4d229ea6e0f82590e48c77b0_NeikiAnalytics.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
2852	3300	WerFault.exe	82
2748	456	WerFault.exe	89
1508	456	WerFault.exe	89
1632	456	WerFault.exe	89
788	456	WerFault.exe	89
1208	456	WerFault.exe	89
4872	456	WerFault.exe	89

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3300	165787fb4d229ea6e0f82590e48c77b0_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
456	165787fb4d229ea6e0f82590e48c77b0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 456	3300	165787fb4d229ea6e0f82590e48c77b0_NeikiAnalytics.exe	89
PID 3300 wrote to memory of 456	3300	165787fb4d229ea6e0f82590e48c77b0_NeikiAnalytics.exe	89
PID 3300 wrote to memory of 456	3300	165787fb4d229ea6e0f82590e48c77b0_NeikiAnalytics.exe	89

C:\Users\Admin\AppData\Local\Temp\165787fb4d229ea6e0f82590e48c77b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\165787fb4d229ea6e0f82590e48c77b0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3300 -s 384
  2⤵
  - Program crash
  PID:2852
- C:\Users\Admin\AppData\Local\Temp\165787fb4d229ea6e0f82590e48c77b0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\165787fb4d229ea6e0f82590e48c77b0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 360
    3⤵
    - Program crash
    PID:2748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 768
    3⤵
    - Program crash
    PID:1508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 788
    3⤵
    - Program crash
    PID:1632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 776
    3⤵
    - Program crash
    PID:788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 792
    3⤵
    - Program crash
    PID:1208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 768
    3⤵
    - Program crash
    PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3300 -ip 3300
1⤵
PID:3148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 456 -ip 456
1⤵
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 456 -ip 456
1⤵
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 456 -ip 456
1⤵
PID:60

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 456 -ip 456
1⤵
PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 456 -ip 456
1⤵
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 456 -ip 456
1⤵
PID:3704

C:\Users\Admin\AppData\Local\Temp\165787fb4d229ea6e0f82590e48c77b0_NeikiAnalytics.exe

Filesize
203KB

MD5
4cad7283d12461c9a8f28c9f6d692247

SHA1
6b600ad6b8b87521f32ca53bbd8b88891f263839

SHA256
f402b835c5f503df88ff8901af953080a728908c1fc7af093cfd893d211f99c8

SHA512
e1c684f21e381bdbed6cfba1041d31120d8883c54a741d49ddc7f6210566bdae561f9036b2a1bdd2c1333128163bb7f1141a34e736fdb33df66e3fe9d7be799e

Download Submit
memory/456-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/456-8-0x00000000001C0000-0x00000000001FE000-memory.dmp

Filesize
248KB

Download
memory/456-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3300-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3300-6-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download