f5127e545612e0a003c86ecc27850fa7784bdc56ade98e8851df5dfa43e71824

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 02:27

Target

2efea3b5418fc348616fae22837c6550_NeikiAnalytics.exe
Size

209KB
MD5

2efea3b5418fc348616fae22837c6550
SHA1

9775a7e7afecb15103b50861dc0d580a757ef606
SHA256

f5127e545612e0a003c86ecc27850fa7784bdc56ade98e8851df5dfa43e71824
SHA512

fed034a80149d1499b45937785261c6c567e59a96e7cc1d6d1ab69901cd7b928d78e8297dad9ddbadca09a38fcea3ae86035c83238a4e6b568309bcd170afd68
SSDEEP

6144:TeDIk2VYAbAlX7ai8eeznrZdEv9ketfXp:TPYAbSaitqr29Ftfp

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4080	2efea3b5418fc348616fae22837c6550_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
4080	2efea3b5418fc348616fae22837c6550_NeikiAnalytics.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4200	2248	WerFault.exe	82
4024	4080	WerFault.exe	89

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2248	2efea3b5418fc348616fae22837c6550_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4080	2efea3b5418fc348616fae22837c6550_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 4080	2248	2efea3b5418fc348616fae22837c6550_NeikiAnalytics.exe	89
PID 2248 wrote to memory of 4080	2248	2efea3b5418fc348616fae22837c6550_NeikiAnalytics.exe	89
PID 2248 wrote to memory of 4080	2248	2efea3b5418fc348616fae22837c6550_NeikiAnalytics.exe	89

C:\Users\Admin\AppData\Local\Temp\2efea3b5418fc348616fae22837c6550_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2efea3b5418fc348616fae22837c6550_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 396
  2⤵
  - Program crash
  PID:4200
- C:\Users\Admin\AppData\Local\Temp\2efea3b5418fc348616fae22837c6550_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\2efea3b5418fc348616fae22837c6550_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 376
    3⤵
    - Program crash
    PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2248 -ip 2248
1⤵
PID:1172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4080 -ip 4080
1⤵
PID:2324

C:\Users\Admin\AppData\Local\Temp\2efea3b5418fc348616fae22837c6550_NeikiAnalytics.exe

Filesize
209KB

MD5
f4a1f382c3146454d8fa5b5e9d252811

SHA1
8e6f5a3a642290cdc4d4cc88dbc0edffb444759e

SHA256
d767137976ccd257d46b89baf798fdaa9963af9c65df907b19f7aff7168e8782

SHA512
f72db2aea031b19828cf6715cb0122cf524d7834a1e127060263c3c66c54494066e323c04762aea0f6b880d23e10dd3d4ca6f9032533434f3942a88e6b8f831a

Download Submit
memory/2248-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2248-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4080-6-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4080-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4080-13-0x00000000014B0000-0x00000000014F0000-memory.dmp

Filesize
256KB

Download