8c20f4ee5737efba868e041be6a194c4c4f52d4ecf88ea3a521b3074a7a1c14f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 21:56

Target

45d522fdff0ea0d34d46517cca7bc790_NeikiAnalytics.exe
Size

200KB
MD5

45d522fdff0ea0d34d46517cca7bc790
SHA1

532d9f00b10659e599ff4f30a4b2e0a9003de134
SHA256

8c20f4ee5737efba868e041be6a194c4c4f52d4ecf88ea3a521b3074a7a1c14f
SHA512

3b36eed13549a686efab62756391498ead6826fa668f65c701a3a3fddd94ce00700748fc8984ea0446c96c796796b22172c9995d9885f12c7008ddaf85dfde69
SSDEEP

3072:wy0QyBG5Imeb/wOoYdQacLnbO3JKpRiDND5erX7skJLBiyLkkLhfVu/N8e:YIIZ/wnYdSnoKj8D5NkJLkIAV8e

Score

7^/10

upx

Executes dropped EXE 1 IoCs

Processes:

45d522fdff0ea0d34d46517cca7bc790_NeikiAnalyticsmgr.exe

pid process

3644 45d522fdff0ea0d34d46517cca7bc790_NeikiAnalyticsmgr.exe

pid	process
3644	45d522fdff0ea0d34d46517cca7bc790_NeikiAnalyticsmgr.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\45d522fdff0ea0d34d46517cca7bc790_NeikiAnalyticsmgr.exe	upx
behavioral2/memory/3644-28-0x0000000000400000-0x0000000000454000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2028 3644 WerFault.exe 45d522fdff0ea0d34d46517cca7bc790_NeikiAnalyticsmgr.exe

pid	pid_target	process	target process
2028	3644	WerFault.exe	45d522fdff0ea0d34d46517cca7bc790_NeikiAnalyticsmgr.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

45d522fdff0ea0d34d46517cca7bc790_NeikiAnalytics.exe

description	pid	process	target process
PID 3456 wrote to memory of 3644	3456	45d522fdff0ea0d34d46517cca7bc790_NeikiAnalytics.exe	45d522fdff0ea0d34d46517cca7bc790_NeikiAnalyticsmgr.exe
PID 3456 wrote to memory of 3644	3456	45d522fdff0ea0d34d46517cca7bc790_NeikiAnalytics.exe	45d522fdff0ea0d34d46517cca7bc790_NeikiAnalyticsmgr.exe
PID 3456 wrote to memory of 3644	3456	45d522fdff0ea0d34d46517cca7bc790_NeikiAnalytics.exe	45d522fdff0ea0d34d46517cca7bc790_NeikiAnalyticsmgr.exe

C:\Users\Admin\AppData\Local\Temp\45d522fdff0ea0d34d46517cca7bc790_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\45d522fdff0ea0d34d46517cca7bc790_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3456

C:\Users\Admin\AppData\Local\Temp\45d522fdff0ea0d34d46517cca7bc790_NeikiAnalyticsmgr.exe
C:\Users\Admin\AppData\Local\Temp\45d522fdff0ea0d34d46517cca7bc790_NeikiAnalyticsmgr.exe
2⤵
- Executes dropped EXE
PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 248
3⤵
- Program crash
PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3644 -ip 3644
1⤵
PID:2116

C:\Users\Admin\AppData\Local\Temp\45d522fdff0ea0d34d46517cca7bc790_NeikiAnalyticsmgr.exe
Filesize
99KB

MD5
f3873258a4258a6761dc54d47463182f

SHA1
fbbf8bca739ca4e9745e5224662b33b437a52461

SHA256
63b02a3e8e7e049d1f29cd4cd79fe5c8905754da6c023df72aa5cca351d0d5c5

SHA512
eec16bb41fd05d9acd5d2b17eb5218057c3cd97cd706e0782a64eb2c32f8a57f1206fe0268be7f37a9f1c3f7b8eb09767cf2724951eaee4be03c4d509d4b3dd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\dotNetFx.log
Filesize
1KB

MD5
faa71de63b4ca0d5b2309aeaec77de9b

SHA1
ae9ba4f539c764315c6c8d50bdd09d7f8f3f409f

SHA256
a571f1e58312490d38b4d7a202bf07e4137dba596699ecb254f672477a8ce11f

SHA512
c1ecaff5d4f4810045bb63739bc956110a541aa1a07b8d4bc15d6a67caf4bce6b6befb6d739efe1fe7315b5dc19b7aed3ebacabb837667df2a9e0c73e880dfc3

Download Submit
memory/3456-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3456-35-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3644-29-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/3644-28-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download