096d0d5771ab64234aa74975f3710bdeef40f3afc361405fe19b7409f6aca77c

Analysis

max time kernel
132s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 04:04

Target

3194fb56ca4c6a18c012357bc90b4320_NeikiAnalytics.exe
Size

108KB
MD5

3194fb56ca4c6a18c012357bc90b4320
SHA1

938b03d6aaf3f81ee465e953e37fea38fe436a0f
SHA256

096d0d5771ab64234aa74975f3710bdeef40f3afc361405fe19b7409f6aca77c
SHA512

deed5838102e2b0b9dfa49cda81fe711d1e24bb1a890014d7f26db9f5b45803b9dc3ebbb51e6ccbdb0b095d2aaa1eccdce3e97a52cbfbe6541651e9821fd313a
SSDEEP

3072:i+Oa8AFGusZI5e+Mp+BC3K5eqU+BC3K5eqYro+X:NIAFG3IaDK70K7qX

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3812	ywswmda.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\ywswmda.exe	3194fb56ca4c6a18c012357bc90b4320_NeikiAnalytics.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3144	3812	WerFault.exe	93

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3812	ywswmda.exe
3812	ywswmda.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3812	ywswmda.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 3532	3812	ywswmda.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3532
- C:\Users\Admin\AppData\Local\Temp\3194fb56ca4c6a18c012357bc90b4320_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\3194fb56ca4c6a18c012357bc90b4320_NeikiAnalytics.exe"
  2⤵
  - Drops file in Program Files directory
  PID:5036

C:\PROGRA~3\Mozilla\ywswmda.exe
C:\PROGRA~3\Mozilla\ywswmda.exe -zhzkoil
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 504
  2⤵
  - Program crash
  PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3812 -ip 3812
1⤵
PID:3800

C:\ProgramData\Mozilla\ywswmda.exe

Filesize
108KB

MD5
1737f01241b7e79de00ad83de252b1b7

SHA1
46f0ea20daed865660f2c861d7d1f370786bbe12

SHA256
c12700daaa744e0e240fadcf01198bde06a4f45fc0de990199a6bdf168d8d724

SHA512
4d7af447341e3ec37dfc2839b004de73fd608890d1973618381391a22891eca147899b30181e688bbf66c3e534f0017ea8e7f94860da4d1d98d4d87493665827

Download Submit
memory/3532-3-0x00000000070F0000-0x000000000710C000-memory.dmp

Filesize
112KB

Download