27228fb292fd3d144e373584bc25aeae69507a4c3e5ac2013481dd93d01b8137

Analysis

max time kernel
141s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 21:32

Target

41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe
Size

202KB
MD5

41094def0fc4232a1a944e0d96cd3bb0
SHA1

7b875ab7bdd2ef167adec5a223c8a92427507b07
SHA256

27228fb292fd3d144e373584bc25aeae69507a4c3e5ac2013481dd93d01b8137
SHA512

7da13a9724937a201f4bd7f02f6a0dea25bf3a93f1c8524716354d649b968b3c83cb0bf0fac086355ce2a20b561479f3203a63b73ef0aaa3e3d383e9e98c6037
SSDEEP

6144:09kwBxO6SXQ/Yr9nWOsVNc2DQ99bu3Ti8FpoVrP:0DSgQxWOl2DeajpoVrP

Score

7^/10

Deletes itself 1 IoCs

Processes:

41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe

pid process

2748 41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe
Executes dropped EXE 1 IoCs

Processes:

41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe

pid process

2748 41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe

pid	process
2748	41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe

pid	process
2748	41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
3548	412	WerFault.exe	41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe
1224	2748	WerFault.exe	41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe

pid process

412 41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe

pid process

2748 41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe

pid	process
412	41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe

pid	process
2748	41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe

description	pid	process	target process
PID 412 wrote to memory of 2748	412	41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe	41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe
PID 412 wrote to memory of 2748	412	41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe	41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe
PID 412 wrote to memory of 2748	412	41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe	41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 396
  2⤵
  - Program crash
  PID:3548
- C:\Users\Admin\AppData\Local\Temp\41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 364
    3⤵
    - Program crash
    PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 412 -ip 412
1⤵
PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2748 -ip 2748
1⤵
PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3776 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:1236

C:\Users\Admin\AppData\Local\Temp\41094def0fc4232a1a944e0d96cd3bb0_NeikiAnalytics.exe

Filesize
202KB

MD5
df138f3ecf5c03675bcf93fcbb3eda60

SHA1
6f34b1188ea0f5ec6ed41a44b1c1c3c8093860bd

SHA256
01be36d4f31dcda2712f167fba4376dcb24514e85137101b8f94c0bb3744496a

SHA512
912850028668eb24fa0fec0e01cb52203d351b6a95a042f659dab53884f930a331bca39bd69c9662714d033c505ff3b3b27126ab137647cbf9c64835977b3b76

Download Submit
memory/412-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/412-6-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2748-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2748-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2748-13-0x00000000014C0000-0x00000000014FE000-memory.dmp

Filesize
248KB

Download
memory/2748-14-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download