ac9bc00fcc902a86e3af51f13ef775ae965f6a78de9c1ddeb2d460d17331db61

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 21:32

Target

8083bb6358116b17772976421d2023b0_NeikiAnalytics.exe
Size

401KB
MD5

8083bb6358116b17772976421d2023b0
SHA1

680bb99ea0d572fc7fc7cae6f29aa939004d2408
SHA256

ac9bc00fcc902a86e3af51f13ef775ae965f6a78de9c1ddeb2d460d17331db61
SHA512

d9cad2206e6ff3b2e229473cbb789ab7f36f8f5b89adffc6cf59c501d87ebbf30d5dfa63f135dadf878f5a0a3acaf2bd5089863f62a3d60591d713dce090fd9f
SSDEEP

6144:YngLkRXg1BC2w9BNISoay+VF2MhFBC3OPO0MzxmlkTaVMzxmlkTanJlnvewRwMzi:YgLh13wvNI0yMFTKeW0MAMU9RwM

Score

7^/10

Deletes itself 1 IoCs

pid	Process
924	8083bb6358116b17772976421d2023b0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
924	8083bb6358116b17772976421d2023b0_NeikiAnalytics.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4128	4656	WerFault.exe	90
1604	924	WerFault.exe	95
2904	924	WerFault.exe	95

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4656	8083bb6358116b17772976421d2023b0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 924	4656	8083bb6358116b17772976421d2023b0_NeikiAnalytics.exe	95
PID 4656 wrote to memory of 924	4656	8083bb6358116b17772976421d2023b0_NeikiAnalytics.exe	95
PID 4656 wrote to memory of 924	4656	8083bb6358116b17772976421d2023b0_NeikiAnalytics.exe	95

C:\Users\Admin\AppData\Local\Temp\8083bb6358116b17772976421d2023b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8083bb6358116b17772976421d2023b0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 396
  2⤵
  - Program crash
  PID:4128
- C:\Users\Admin\AppData\Local\Temp\8083bb6358116b17772976421d2023b0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\8083bb6358116b17772976421d2023b0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 364
    3⤵
    - Program crash
    PID:1604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 164
    3⤵
    - Program crash
    PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4656 -ip 4656
1⤵
PID:800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 924 -ip 924
1⤵
PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 924 -ip 924
1⤵
PID:2460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4148 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:4672

C:\Users\Admin\AppData\Local\Temp\8083bb6358116b17772976421d2023b0_NeikiAnalytics.exe

Filesize
401KB

MD5
5fd9c0ad3341a26ccc89e35ca20ee2ae

SHA1
74ed26edabe754d0c8c905f5ed8b326a13bf3f99

SHA256
2ab6510e47302952e979508cee906e09203c39d0ab2d22abe2d02ff016ecb93a

SHA512
8782fd63aa4d174feda724eeb2433494ccc561613acb15db56a83a546ec87373a3e2a158b813ad51333527e14fb83fc538710602d3d5482c9158ccd90956aa4b

Download Submit
memory/924-9-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/924-11-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4656-0-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4656-8-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download