3c1604be113855ef568c611d2e02700b63b81b93cbb374f28c2df598c1b58982

Analysis

max time kernel
138s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 11:03

Target

3c1604be113855ef568c611d2e02700b63b81b93cbb374f28c2df598c1b58982_NeikiAnalytics.exe
Size

200KB
MD5

264685c79c56fc38438227ea8896e920
SHA1

82627b2aa2bd7d2ef5dbaa7b8e9a2a2c97a4a217
SHA256

3c1604be113855ef568c611d2e02700b63b81b93cbb374f28c2df598c1b58982
SHA512

bcbaf064d157dad777e8428262ab312f0eb328b035bad0f81977ff070a20c08ae00a3d04d34298bfffa566c55ecdb5fbdcb70db91ebf1a46545ddad7a2e6b8c6
SSDEEP

6144:KexwTXcuuZ9AYwOFWfUnp4g8kVdpG1B7u:KQUXcuujAYVFWfUnp4qG1BC

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3160	3c1604be113855ef568c611d2e02700b63b81b93cbb374f28c2df598c1b58982_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
3160	3c1604be113855ef568c611d2e02700b63b81b93cbb374f28c2df598c1b58982_NeikiAnalytics.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4940	4508	WerFault.exe	82
688	3160	WerFault.exe	89

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4508	3c1604be113855ef568c611d2e02700b63b81b93cbb374f28c2df598c1b58982_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3160	3c1604be113855ef568c611d2e02700b63b81b93cbb374f28c2df598c1b58982_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 3160	4508	3c1604be113855ef568c611d2e02700b63b81b93cbb374f28c2df598c1b58982_NeikiAnalytics.exe	89
PID 4508 wrote to memory of 3160	4508	3c1604be113855ef568c611d2e02700b63b81b93cbb374f28c2df598c1b58982_NeikiAnalytics.exe	89
PID 4508 wrote to memory of 3160	4508	3c1604be113855ef568c611d2e02700b63b81b93cbb374f28c2df598c1b58982_NeikiAnalytics.exe	89

C:\Users\Admin\AppData\Local\Temp\3c1604be113855ef568c611d2e02700b63b81b93cbb374f28c2df598c1b58982_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3c1604be113855ef568c611d2e02700b63b81b93cbb374f28c2df598c1b58982_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 376
  2⤵
  - Program crash
  PID:4940
- C:\Users\Admin\AppData\Local\Temp\3c1604be113855ef568c611d2e02700b63b81b93cbb374f28c2df598c1b58982_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\3c1604be113855ef568c611d2e02700b63b81b93cbb374f28c2df598c1b58982_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 364
    3⤵
    - Program crash
    PID:688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4508 -ip 4508
1⤵
PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3160 -ip 3160
1⤵
PID:4448

C:\Users\Admin\AppData\Local\Temp\3c1604be113855ef568c611d2e02700b63b81b93cbb374f28c2df598c1b58982_NeikiAnalytics.exe

Filesize
200KB

MD5
ccd66886ffceb234afb8e8d9d6810e15

SHA1
2876f0aa0bb03744e3bbff9282f31101e3a8f806

SHA256
c40ff3819ff7b2127f01a26dd295fa99fba926c6eb66c092160827b65c08ba1b

SHA512
1a2ae261d0d80f7357d0e20733928c27d8a98c2237c5989077aebdad18b7268a873d3840c36a7afe6743ed9b241081ade7272496f8e0ccf391b392a04c84dfb2

Download Submit
memory/3160-7-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3160-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3160-13-0x0000000001510000-0x000000000154F000-memory.dmp

Filesize
252KB

Download
memory/4508-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4508-6-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download