a58fb361e9934316d70c1b789f4991f669cb759ba5c3ff3f0961f7b79f7f0fa9

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:38

Target

362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe
Size

453KB
MD5

362fcacb888ee6ef647a6559d1d47720
SHA1

ed24497bc3183a52efc0132c288398bc7b1a9437
SHA256

a58fb361e9934316d70c1b789f4991f669cb759ba5c3ff3f0961f7b79f7f0fa9
SHA512

527ca40310865995411d4f80a637667cd476cbb07eb1a988beabd0250888a2811e4f3d947750affc07be15971bccc42fe8f1b990daa75892a30d86f68d9db60f
SSDEEP

6144:9hoYSsYIlk9+eMsx5sZ20W7cyqCxSngmMBqfycuPbUl0i5cD5J6b8pS0wULW:9SDG+Ien7gk0npM4dl0v5JHpS0wULW

Score

7^/10

Deletes itself 1 IoCs

Processes:

362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe

pid process

2548 362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe
Executes dropped EXE 1 IoCs

Processes:

362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe

pid process

2548 362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe

pid	process
2548	362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe

pid	process
2548	362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe

Program crash 7 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1216	3520	WerFault.exe	362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe
2796	2548	WerFault.exe	362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe
4180	2548	WerFault.exe	362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe
2428	2548	WerFault.exe	362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe
2564	2548	WerFault.exe	362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe
4404	2548	WerFault.exe	362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe
4852	2548	WerFault.exe	362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe

pid process

3520 362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe

pid process

2548 362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe

pid	process
3520	362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe

pid	process
2548	362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe

description	pid	process	target process
PID 3520 wrote to memory of 2548	3520	362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe	362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe
PID 3520 wrote to memory of 2548	3520	362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe	362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe
PID 3520 wrote to memory of 2548	3520	362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe	362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 384
2⤵
- Program crash
PID:1216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 352
3⤵
- Program crash
PID:2796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 768
3⤵
- Program crash
PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 808
3⤵
- Program crash
PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 816
3⤵
- Program crash
PID:2564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 544
3⤵
- Program crash
PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 776
3⤵
- Program crash
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3520 -ip 3520
1⤵
PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2548 -ip 2548
1⤵
PID:3984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2548 -ip 2548
1⤵
PID:1796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2548 -ip 2548
1⤵
PID:336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2548 -ip 2548
1⤵
PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2548 -ip 2548
1⤵
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2548 -ip 2548
1⤵
PID:4076

C:\Users\Admin\AppData\Local\Temp\362fcacb888ee6ef647a6559d1d47720_NeikiAnalytics.exe

Filesize
453KB

MD5
d9c5161063cd1eba2f7a6c6a75a4fd2c

SHA1
edc6f8407968ec6d3e86e65669de0f08a5ca7f37

SHA256
78e12f9f31a951b6fdbf4803af64c02157d931a218631a53f1c65502f1cfffc6

SHA512
52e31254e159e5a2b3c8dd4b287ff6a75dab4d7f0377fc3b2e1a35378ad7a0a9f013992627dab70a8277cb1bf6e2676541d2a1b7dfd9ee94010441b359d19bf1

Download Submit
memory/2548-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2548-8-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2548-13-0x00000000014D0000-0x000000000150E000-memory.dmp

Filesize
248KB

Download
memory/3520-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3520-6-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download