e52dede55cd8e81203afe2016032aadd190a105226e7b42acf1c6c0817ac896c

Analysis

max time kernel
134s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 18:52

Target

0d4c2d89176acef92a7c60fae4a14f50_NeikiAnalytics.exe
Size

4.1MB
MD5

0d4c2d89176acef92a7c60fae4a14f50
SHA1

0f824f92cb26db870ee3e81f874704949679c28a
SHA256

e52dede55cd8e81203afe2016032aadd190a105226e7b42acf1c6c0817ac896c
SHA512

69d94aae305740584967ba87c21aafc67fc11861a7ef3d87810bd8712b4c2e8afe2db9e8a77193b9686b630a467a622c5a1a205e2493e1faea5c386a0f43c284
SSDEEP

24576:QTu/hCd+/1aPZSVTb+eezha/ZSbpYvxYTqD2Rkea/ZSAajJBMqAX1Ea/pSOue+l:6dC1Q6XMhgSVgCo/OgTw

Score

7^/10

Deletes itself 1 IoCs

pid	Process
5076	0d4c2d89176acef92a7c60fae4a14f50_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
5076	0d4c2d89176acef92a7c60fae4a14f50_NeikiAnalytics.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2848	400	WerFault.exe	81
732	5076	WerFault.exe	89
4692	5076	WerFault.exe	89

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
400	0d4c2d89176acef92a7c60fae4a14f50_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
5076	0d4c2d89176acef92a7c60fae4a14f50_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 5076	400	0d4c2d89176acef92a7c60fae4a14f50_NeikiAnalytics.exe	89
PID 400 wrote to memory of 5076	400	0d4c2d89176acef92a7c60fae4a14f50_NeikiAnalytics.exe	89
PID 400 wrote to memory of 5076	400	0d4c2d89176acef92a7c60fae4a14f50_NeikiAnalytics.exe	89

C:\Users\Admin\AppData\Local\Temp\0d4c2d89176acef92a7c60fae4a14f50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0d4c2d89176acef92a7c60fae4a14f50_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 344
  2⤵
  - Program crash
  PID:2848
- C:\Users\Admin\AppData\Local\Temp\0d4c2d89176acef92a7c60fae4a14f50_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\0d4c2d89176acef92a7c60fae4a14f50_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:5076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 344
    3⤵
    - Program crash
    PID:732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 392
    3⤵
    - Program crash
    PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 400 -ip 400
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 5076 -ip 5076
1⤵
PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5076 -ip 5076
1⤵
PID:3584

C:\Users\Admin\AppData\Local\Temp\0d4c2d89176acef92a7c60fae4a14f50_NeikiAnalytics.exe

Filesize
4.1MB

MD5
477163a2f3160a24400baed775b0673e

SHA1
5c93d5e713b8d0ff3611c910c35bddf9d8afc6bd

SHA256
ec643d51a506ce6948b2fff7dd8f2f73bfc47a672077852443674137ce8c0c5a

SHA512
bc667be559c111212c08209e5d7e9811e310de486f2ec1ff31aa882e387a3a53c2e97fea2ba7becf25b92983d32b2d9bf5cdc109bc8c5e176167ebb14834e08d

Download Submit
memory/400-0-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/400-6-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/5076-7-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/5076-8-0x0000000005090000-0x000000000517C000-memory.dmp

Filesize
944KB

Download
memory/5076-9-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download