14891b38d40bd36b869dca1bb530326fec9e9b84b9537da100519c597bccf1e8

Analysis

max time kernel
140s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 21:47

Target

44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe
Size

256KB
MD5

44086e4adf9e0cd42cf16dff922d3670
SHA1

48f6dde0e192e0f1a67e8e03ab3bec5eeb136336
SHA256

14891b38d40bd36b869dca1bb530326fec9e9b84b9537da100519c597bccf1e8
SHA512

66d64dcb58b2aa93627f2c0b39f0f7dfbec4ac7d72134be76b00707d5d2f73878e54d6f7cb98d0b0f1891d0a339c06e5b2889610afb2f6b861f6caa5c118ddc4
SSDEEP

6144:h41EqPKughc0TtGLczjsvlMB9Ng9mf4meMm5+2k/JrAV400:h41quW4csyTg64meMm5+2qJrAVw

Score

7^/10

Deletes itself 1 IoCs

Processes:

44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe

pid process

1568 44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe
Executes dropped EXE 1 IoCs

Processes:

44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe

pid process

1568 44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe

pid	process
1568	44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe

pid	process
1568	44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
3604	4596	WerFault.exe	44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe
1848	1568	WerFault.exe	44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe

pid process

4596 44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe

pid process

1568 44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe

pid	process
4596	44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe

pid	process
1568	44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe

description	pid	process	target process
PID 4596 wrote to memory of 1568	4596	44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe	44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe
PID 4596 wrote to memory of 1568	4596	44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe	44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe
PID 4596 wrote to memory of 1568	4596	44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe	44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 396
  2⤵
  - Program crash
  PID:3604
- C:\Users\Admin\AppData\Local\Temp\44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 364
    3⤵
    - Program crash
    PID:1848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4596 -ip 4596
1⤵
PID:2708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1568 -ip 1568
1⤵
PID:3264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4064 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:768

C:\Users\Admin\AppData\Local\Temp\44086e4adf9e0cd42cf16dff922d3670_NeikiAnalytics.exe

Filesize
256KB

MD5
bc561172e8ef02dc79b497945ae500d4

SHA1
29f7803f404980a73fdfa07f03c2cb28943e011f

SHA256
81847f4ee9c4fd3ce53715a72e257bdd5dca729f7d4f30729e502625c5b1ee3f

SHA512
2954300c41a4c8c4076350f76e40076eae78186939347076423f96464844faea6ac5dff002c4c1308dca4e7657cf711dc77cde3ad13deceb6c6c489f1668105b

Download Submit
memory/1568-7-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1568-9-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1568-13-0x0000000004DA0000-0x0000000004DE3000-memory.dmp

Filesize
268KB

Download
memory/1568-14-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4596-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4596-6-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download