8bc9933afbff2130fab20fa325847688168e7503b3f8582604d9c809c0063e63

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 19:25

Target

069c84895665244b94bda9844249be30_NeikiAnalytics.exe
Size

448KB
MD5

069c84895665244b94bda9844249be30
SHA1

16bc3b655658c5b3f2e1605eed4be637ce9783e3
SHA256

8bc9933afbff2130fab20fa325847688168e7503b3f8582604d9c809c0063e63
SHA512

9a03746795efd63003f8602a4835067f1fc653e93ad4b2e68196365070498a53aabefa22caa3058430309809f5906359c61e16e48e1c69a6da39aa51683966a7
SSDEEP

12288:xYGz19funv+GIbRSz/PcF8hadG1BmVQ5zCD4TyWN9VN:xYGHfunvRIbA8eUdG1BmVQ5zY4xN9VN

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1200	069c84895665244b94bda9844249be30_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
1200	069c84895665244b94bda9844249be30_NeikiAnalytics.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3220	3156	WerFault.exe	82
376	1200	WerFault.exe	88

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3156	069c84895665244b94bda9844249be30_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1200	069c84895665244b94bda9844249be30_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 1200	3156	069c84895665244b94bda9844249be30_NeikiAnalytics.exe	88
PID 3156 wrote to memory of 1200	3156	069c84895665244b94bda9844249be30_NeikiAnalytics.exe	88
PID 3156 wrote to memory of 1200	3156	069c84895665244b94bda9844249be30_NeikiAnalytics.exe	88

C:\Users\Admin\AppData\Local\Temp\069c84895665244b94bda9844249be30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\069c84895665244b94bda9844249be30_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 396
  2⤵
  - Program crash
  PID:3220
- C:\Users\Admin\AppData\Local\Temp\069c84895665244b94bda9844249be30_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\069c84895665244b94bda9844249be30_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 364
    3⤵
    - Program crash
    PID:376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3156 -ip 3156
1⤵
PID:3320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1200 -ip 1200
1⤵
PID:764

C:\Users\Admin\AppData\Local\Temp\069c84895665244b94bda9844249be30_NeikiAnalytics.exe

Filesize
448KB

MD5
af3d67eb9ee34597ba68b47920154851

SHA1
cb44363b826d3c633b3f94bc862ea150e0db635a

SHA256
62ce71c98bbae44654a48b6d42888dfefe214430cc85d97f7f539735ddb670df

SHA512
da9632f97a5757be2e09c5266ce66fb5de4d5721bb2ad73e86975ff27d6e568150d9f02dc4beee94eca0c229fd1189ad365018cdad685f73ae6fd42e268adca4

Download Submit
memory/1200-7-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1200-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1200-13-0x00000000014A0000-0x00000000014DF000-memory.dmp

Filesize
252KB

Download
memory/3156-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3156-6-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download