3fe244585b281dce88c9f11ff8ceede9d4b2aadd46ffc5b2dad3e34291a55ae1

Analysis

max time kernel
143s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 07:36

Target

cca0018fb98d58d9442f116027785c50_NeikiAnalytics.exe
Size

197KB
MD5

cca0018fb98d58d9442f116027785c50
SHA1

8302becd8deb3ef4a155401789d82520cc0d62d3
SHA256

3fe244585b281dce88c9f11ff8ceede9d4b2aadd46ffc5b2dad3e34291a55ae1
SHA512

aae931cf91164505df57e80561d0a7e1b87f8287a018afa11ab2467f2b430506dd4cc01d9f90f5d6c526fb495e3319cae57d2900b900bc5a3b40863db2ae5b31
SSDEEP

6144:MWRmaMplFINh1+Mpd1H1/qEhBoa+WZ3o8Uc21MY729W45oGRNUpCyGH6Y6l:MW7JLUc2x8WuJNeCyfv

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2860	cca0018fb98d58d9442f116027785c50_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2860	cca0018fb98d58d9442f116027785c50_NeikiAnalytics.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
2196	2240	WerFault.exe	82
3508	2860	WerFault.exe	87
2944	2860	WerFault.exe	87
116	2860	WerFault.exe	87
4356	2860	WerFault.exe	87
2924	2860	WerFault.exe	87
4632	2860	WerFault.exe	87

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2240	cca0018fb98d58d9442f116027785c50_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2860	cca0018fb98d58d9442f116027785c50_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2860	2240	cca0018fb98d58d9442f116027785c50_NeikiAnalytics.exe	87
PID 2240 wrote to memory of 2860	2240	cca0018fb98d58d9442f116027785c50_NeikiAnalytics.exe	87
PID 2240 wrote to memory of 2860	2240	cca0018fb98d58d9442f116027785c50_NeikiAnalytics.exe	87

C:\Users\Admin\AppData\Local\Temp\cca0018fb98d58d9442f116027785c50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\cca0018fb98d58d9442f116027785c50_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 384
  2⤵
  - Program crash
  PID:2196
- C:\Users\Admin\AppData\Local\Temp\cca0018fb98d58d9442f116027785c50_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\cca0018fb98d58d9442f116027785c50_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 352
    3⤵
    - Program crash
    PID:3508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 768
    3⤵
    - Program crash
    PID:2944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 788
    3⤵
    - Program crash
    PID:116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 776
    3⤵
    - Program crash
    PID:4356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 772
    3⤵
    - Program crash
    PID:2924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 768
    3⤵
    - Program crash
    PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2240 -ip 2240
1⤵
PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2860 -ip 2860
1⤵
PID:812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2860 -ip 2860
1⤵
PID:2344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2860 -ip 2860
1⤵
PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2860 -ip 2860
1⤵
PID:2356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2860 -ip 2860
1⤵
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2860 -ip 2860
1⤵
PID:1956

C:\Users\Admin\AppData\Local\Temp\cca0018fb98d58d9442f116027785c50_NeikiAnalytics.exe

Filesize
197KB

MD5
79978d7a3662863e2deea23682429262

SHA1
722fb5b87aae0db9cbddb2e2d6302658db9ca42b

SHA256
b0905ee51346cb66774ce3561f8c96f33a8aba2399ff2c830367ab07c1b0774d

SHA512
588d42833ff518aaf1d1ae4f58076814578cca04178e3524e24b7e45c3190d2097a8da7b21230b518c811a3d8f13697ab17b5a250edb666b4d3dec9a247963fb

Download Submit
memory/2240-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2240-6-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2860-7-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2860-8-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2860-13-0x00000000001A0000-0x00000000001DF000-memory.dmp

Filesize
252KB

Download
memory/2860-14-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download