0cd59a6895540794a339b2f8af9ad2d43913989c6489c3835e6187c26e77d1e6

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2024 11:36

Target

a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe
Size

1.0MB
MD5

a20aa75ae65fde9d6c346e54107caff0
SHA1

395d2493240c7c066f85ef3e63fc367d69ec1573
SHA256

0cd59a6895540794a339b2f8af9ad2d43913989c6489c3835e6187c26e77d1e6
SHA512

661f9d6dbcac29fe4124ac69141d4295256ea87e890b0851bc171c292d25c394a65d839f8bb17dc34d9ac8d4d921a5166cbb397713ed41018221177829355b3f
SSDEEP

12288:DNHbKFvpdgFW39cq5AjehJAHm6IjVDaPZSVTzH3hf8Ctzu:ZHKpdgFiaQJXaPZSVTb+eK

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3312	a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
3312	a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4728	452	WerFault.exe	82
400	3312	WerFault.exe	89
3980	3312	WerFault.exe	89

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
452	a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3312	a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 3312	452	a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe	89
PID 452 wrote to memory of 3312	452	a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe	89
PID 452 wrote to memory of 3312	452	a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe	89

C:\Users\Admin\AppData\Local\Temp\a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 352
  2⤵
  - Program crash
  PID:4728
- C:\Users\Admin\AppData\Local\Temp\a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 344
    3⤵
    - Program crash
    PID:400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 344
    3⤵
    - Program crash
    PID:3980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 452 -ip 452
1⤵
PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3312 -ip 3312
1⤵
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3312 -ip 3312
1⤵
PID:1360

C:\Users\Admin\AppData\Local\Temp\a20aa75ae65fde9d6c346e54107caff0_NeikiAnalytics.exe

Filesize
1.0MB

MD5
a170c57dd51cf26c557fb92ff9bdef6a

SHA1
963945dcbc54af8bf28eb04b4ebb59a298780bf3

SHA256
5a2f5de3095f7054390e05fd352f34738199642dc53bfe4de5af30bb27443efc

SHA512
b62fed87f26a47b9d05ba08529e6689d50af55122d953f8bd2e218a9293cf6e60bf8650e8080d66f8c6b52cdb28899a0334cf1c7ba04574a3ba5e29d5bb335c8

Download Submit
memory/452-0-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/452-6-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/3312-7-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/3312-8-0x0000000005140000-0x000000000522C000-memory.dmp

Filesize
944KB

Download
memory/3312-10-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download