7e01312a92178539584bcd84eaa208a96b7536943e3c7c53d9815a42e01cfed6

Analysis

max time kernel
132s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 07:44

Target

2af4b474f685490a9ef4329316ee45a0_NeikiAnalytics.exe
Size

192KB
MD5

2af4b474f685490a9ef4329316ee45a0
SHA1

aabe6742f530401f1a1e9816a03d4c7b6a1b88d9
SHA256

7e01312a92178539584bcd84eaa208a96b7536943e3c7c53d9815a42e01cfed6
SHA512

f5927fad8725412a6131e706fc360114f974b7be994d29ca596d9d768878af142e087c921ede9be094373433e3115478fb019c54668b9c23f771e6bc4c7af3a1
SSDEEP

3072:XeZbbJiKBV3OpX/6caafxR1USdiou6tgG36Usow9iXkKW7zDIbKrd/K0s7:XeZ5iKs4af3kZ6rsouiYzHp/K1

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1004	2af4b474f685490a9ef4329316ee45a0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
1004	2af4b474f685490a9ef4329316ee45a0_NeikiAnalytics.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2848	4372	WerFault.exe	81
1648	1004	WerFault.exe	86

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4372	2af4b474f685490a9ef4329316ee45a0_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1004	2af4b474f685490a9ef4329316ee45a0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 1004	4372	2af4b474f685490a9ef4329316ee45a0_NeikiAnalytics.exe	86
PID 4372 wrote to memory of 1004	4372	2af4b474f685490a9ef4329316ee45a0_NeikiAnalytics.exe	86
PID 4372 wrote to memory of 1004	4372	2af4b474f685490a9ef4329316ee45a0_NeikiAnalytics.exe	86

C:\Users\Admin\AppData\Local\Temp\2af4b474f685490a9ef4329316ee45a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2af4b474f685490a9ef4329316ee45a0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 396
  2⤵
  - Program crash
  PID:2848
- C:\Users\Admin\AppData\Local\Temp\2af4b474f685490a9ef4329316ee45a0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\2af4b474f685490a9ef4329316ee45a0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 372
    3⤵
    - Program crash
    PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4372 -ip 4372
1⤵
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1004 -ip 1004
1⤵
PID:4812

C:\Users\Admin\AppData\Local\Temp\2af4b474f685490a9ef4329316ee45a0_NeikiAnalytics.exe

Filesize
192KB

MD5
238d469deb510125ba68a3c5b2510f55

SHA1
3a1590bd4e383c7d4f60c7fd0cba4774d4cda23e

SHA256
88999f77c3a4f70ed2ff779d08e41465f50f282f04d916329f69f439e797c5da

SHA512
f69525c88ee5a1adb71e7718d96ab2ab1896651797c6087be30106ac1577faaafc53bb8f820a2fdba981e818b542cc1e5028599e757f5f5a30b0308862cf58a0

Download Submit
memory/1004-8-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1004-9-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1004-14-0x00000000014D0000-0x0000000001507000-memory.dmp

Filesize
220KB

Download
memory/4372-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4372-7-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download