0cdf2d2691077c13e8e6df3cb7b2da7f81934d90d44a59b20aaa623b14feb26f

Analysis

max time kernel
145s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:23

Target

61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe
Size

768KB
MD5

61747641205be9a9747ad35a6833d990
SHA1

12757e38160755e487695988f6fb392ada09f32a
SHA256

0cdf2d2691077c13e8e6df3cb7b2da7f81934d90d44a59b20aaa623b14feb26f
SHA512

292884c0ed61de67555077108368c59ebc7e9c3f870c96d068a906210f3724ca7045a173b777f913b3cd9a541763a81f7ab88d4fb7892e9684bafba16131c1e8
SSDEEP

12288:zcv0A2nUUUEvAWjPPbUiYr7j0npM4dl0v5Jdm5IgVQBHzS+iYf8MWcqxgJj5v37p:E7jEM4dmv5BTqV0EM42

Score

7^/10

Deletes itself 1 IoCs

Processes:

61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe

pid process

2180 61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe
Executes dropped EXE 1 IoCs

Processes:

61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe

pid process

2180 61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe

pid	process
2180	61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe

pid	process
2180	61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe

Program crash 7 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1112	2392	WerFault.exe	61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe
3496	2180	WerFault.exe	61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe
468	2180	WerFault.exe	61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe
4824	2180	WerFault.exe	61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe
3152	2180	WerFault.exe	61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe
1836	2180	WerFault.exe	61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe
896	2180	WerFault.exe	61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe

pid process

2392 61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe

pid process

2180 61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe

pid	process
2392	61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe

pid	process
2180	61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe

description	pid	process	target process
PID 2392 wrote to memory of 2180	2392	61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe	61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe
PID 2392 wrote to memory of 2180	2392	61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe	61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe
PID 2392 wrote to memory of 2180	2392	61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe	61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 384
2⤵
- Program crash
PID:1112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 360
3⤵
- Program crash
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 768
3⤵
- Program crash
PID:468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 788
3⤵
- Program crash
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 784
3⤵
- Program crash
PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 792
3⤵
- Program crash
PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 780
3⤵
- Program crash
PID:896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2392 -ip 2392
1⤵
PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2180 -ip 2180
1⤵
PID:2008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2180 -ip 2180
1⤵
PID:2800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2180 -ip 2180
1⤵
PID:2896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2180 -ip 2180
1⤵
PID:1616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2180 -ip 2180
1⤵
PID:3416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2180 -ip 2180
1⤵
PID:4060

C:\Users\Admin\AppData\Local\Temp\61747641205be9a9747ad35a6833d990_NeikiAnalytics.exe

Filesize
768KB

MD5
6c8ab40f8faf3d1990653e2d49bf9121

SHA1
8fafd6fdbdd8cc52ed4b34d82dd984ac47854af2

SHA256
47c07db1ed2ffc1ab507d85a9bfe4ee54ef790a844748a775d82077653420f10

SHA512
c819ac8c54b87e31fa359394f2faa2d3bb7877b856af7028e8feb6c9b199f24814105e01160312dda36e0b0b9ba8146fb12233e1b92f19447707722dcd1c43b7

Download Submit
memory/2180-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2180-8-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2180-13-0x00000000001A0000-0x00000000001E1000-memory.dmp

Filesize
260KB

Download
memory/2392-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2392-6-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download