0ae95d09050fc4bfd1cd7a4596a9b893cf235e009cd5a4e51f5d24930444dec3

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:34

Target

351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe
Size

448KB
MD5

351fa860e26a088738d90491f9561fc0
SHA1

91b1e3e771861058c312b7142a88f5d7d8647816
SHA256

0ae95d09050fc4bfd1cd7a4596a9b893cf235e009cd5a4e51f5d24930444dec3
SHA512

1bc14c0a1458e1e478adfafa3aa6fe6832842c0120c73b718ad6e2269be3d551628cb97e964a5372042a446ca94a4dafd1593814dac1e21a186a4e7d555b6e5a
SSDEEP

6144:ZADJx0Nkr4IjKAy5w0W7cyqCxSngmMBqfycuPbUl0i5cD5J6qPNaB3+4xoU8cZa/:ZOJxYM4Ij1y00npM4dl0v5Jpk3B8

Score

7^/10

Deletes itself 1 IoCs

Processes:

351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe

pid process

4460 351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe
Executes dropped EXE 1 IoCs

Processes:

351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe

pid process

4460 351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe

pid	process
4460	351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe

pid	process
4460	351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe

Program crash 7 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4828	3440	WerFault.exe	351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe
1372	4460	WerFault.exe	351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe
2864	4460	WerFault.exe	351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe
3512	4460	WerFault.exe	351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe
4328	4460	WerFault.exe	351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe
8	4460	WerFault.exe	351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe
1564	4460	WerFault.exe	351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe

pid process

3440 351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe

pid process

4460 351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe

pid	process
3440	351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe

pid	process
4460	351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe

description	pid	process	target process
PID 3440 wrote to memory of 4460	3440	351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe	351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe
PID 3440 wrote to memory of 4460	3440	351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe	351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe
PID 3440 wrote to memory of 4460	3440	351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe	351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 384
2⤵
- Program crash
PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 360
3⤵
- Program crash
PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 768
3⤵
- Program crash
PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 788
3⤵
- Program crash
PID:3512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 772
3⤵
- Program crash
PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 768
3⤵
- Program crash
PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 776
3⤵
- Program crash
PID:1564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3440 -ip 3440
1⤵
PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4460 -ip 4460
1⤵
PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4460 -ip 4460
1⤵
PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4460 -ip 4460
1⤵
PID:1168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4460 -ip 4460
1⤵
PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4460 -ip 4460
1⤵
PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4460 -ip 4460
1⤵
PID:3688

C:\Users\Admin\AppData\Local\Temp\351fa860e26a088738d90491f9561fc0_NeikiAnalytics.exe
Filesize
448KB

MD5
5e7926b17d8341e6636fd11daa732f9b

SHA1
ef854afe1ac6d8b25baea69161d852a4400520d2

SHA256
ce0e90ca593e5b172c42ea516bdcf77617d402d40d6b2fd9f7f52729a71f52ad

SHA512
2dffcf3be6dce06195ff38e3604be957ba61e5afc5684eaa828a04aa578a88c2e732d64541ca08f0fe937cca64c27d9a008340fa69b03ac723708b1fdd1d2348

Download Submit
memory/3440-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3440-7-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4460-8-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4460-9-0x0000000004D90000-0x0000000004DC5000-memory.dmp

Filesize
212KB

Download
memory/4460-10-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download