b940367181cb10d93429c97b2415a316ea584f9a7eb84d76ffa72cbdfad558d3

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 07:58

Target

5eb39736fc1a5e04201aa57a807f13a0_NeikiAnalytics.exe
Size

416KB
MD5

5eb39736fc1a5e04201aa57a807f13a0
SHA1

4d2918178b4a4ae2d5c208cfae71422283d2c873
SHA256

b940367181cb10d93429c97b2415a316ea584f9a7eb84d76ffa72cbdfad558d3
SHA512

4ac18bca1b822efb4cbd9de9e461d2496c4ce9135465693e11403bf60f98a2820f12df9394b4ad417ca2c510fe7272ef9d4118b87fa3d3a6cc83b2d0a59bbed8
SSDEEP

12288:62p8D02ntpKzey5o6Xtg8kRahXkO1sYkqZX9aLisvNeOVQ5zCD4TyWNz:6m2nAQoPX9aLisvNeOVQ5zY4xNz

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4356	5eb39736fc1a5e04201aa57a807f13a0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4356	5eb39736fc1a5e04201aa57a807f13a0_NeikiAnalytics.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3016	2660	WerFault.exe	82
436	4356	WerFault.exe	88

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2660	5eb39736fc1a5e04201aa57a807f13a0_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4356	5eb39736fc1a5e04201aa57a807f13a0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 4356	2660	5eb39736fc1a5e04201aa57a807f13a0_NeikiAnalytics.exe	88
PID 2660 wrote to memory of 4356	2660	5eb39736fc1a5e04201aa57a807f13a0_NeikiAnalytics.exe	88
PID 2660 wrote to memory of 4356	2660	5eb39736fc1a5e04201aa57a807f13a0_NeikiAnalytics.exe	88

C:\Users\Admin\AppData\Local\Temp\5eb39736fc1a5e04201aa57a807f13a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5eb39736fc1a5e04201aa57a807f13a0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 376
  2⤵
  - Program crash
  PID:3016
- C:\Users\Admin\AppData\Local\Temp\5eb39736fc1a5e04201aa57a807f13a0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\5eb39736fc1a5e04201aa57a807f13a0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 372
    3⤵
    - Program crash
    PID:436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2660 -ip 2660
1⤵
PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4356 -ip 4356
1⤵
PID:2800

C:\Users\Admin\AppData\Local\Temp\5eb39736fc1a5e04201aa57a807f13a0_NeikiAnalytics.exe

Filesize
416KB

MD5
74d1d93da3c92af7e7a0e899d39cf016

SHA1
03dc5242223c3bce65e64452d0162838ab4a1491

SHA256
e888077cb2c045105bf9e2874ffc88e92c953461054180e79ca3d76cec8ac19b

SHA512
1e843c26b8f618c7bca7980d3911670cbdac82d555c9bc8778faedad1f25583f73a80524257e697e3cd5d529c69e93a4dfa33915200256fc1de789106e0f5d3b

Download Submit
memory/2660-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2660-6-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4356-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4356-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4356-13-0x0000000003D90000-0x0000000003DD2000-memory.dmp

Filesize
264KB

Download