52ceb9260480b5a6d93f571104f73acd30ae07c9f8b25c4188eb4ea161a29964

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 09:48

Target

30a63a4b19eacb84cc0ac49d927a58e0_NeikiAnalytics.exe
Size

885KB
MD5

30a63a4b19eacb84cc0ac49d927a58e0
SHA1

2be59b3b2b8c1b56633fb72dc4278bf9d7aeb8a8
SHA256

52ceb9260480b5a6d93f571104f73acd30ae07c9f8b25c4188eb4ea161a29964
SHA512

d5a4376ab7e457a1f60644a70906d7e7fa98888a2785a1e02dce2cf0af731b57e2ec8117f22641cb3683b4d7a64346ade397af458a452525044cdb60b102d6df
SSDEEP

6144:Yr17ZfVaaiv2m7DK3sY5QtEr2fPp/1PmbonsnYzsC55YswABrxxJa/YESy:k7VVaaiuH3Z5lcPTpAgisjlDa/ZSy

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2320	30a63a4b19eacb84cc0ac49d927a58e0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2320	30a63a4b19eacb84cc0ac49d927a58e0_NeikiAnalytics.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1800	3688	WerFault.exe	81
1688	2320	WerFault.exe	89
768	2320	WerFault.exe	89

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3688	30a63a4b19eacb84cc0ac49d927a58e0_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2320	30a63a4b19eacb84cc0ac49d927a58e0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 2320	3688	30a63a4b19eacb84cc0ac49d927a58e0_NeikiAnalytics.exe	89
PID 3688 wrote to memory of 2320	3688	30a63a4b19eacb84cc0ac49d927a58e0_NeikiAnalytics.exe	89
PID 3688 wrote to memory of 2320	3688	30a63a4b19eacb84cc0ac49d927a58e0_NeikiAnalytics.exe	89

C:\Users\Admin\AppData\Local\Temp\30a63a4b19eacb84cc0ac49d927a58e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\30a63a4b19eacb84cc0ac49d927a58e0_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 344
  2⤵
  - Program crash
  PID:1800
- C:\Users\Admin\AppData\Local\Temp\30a63a4b19eacb84cc0ac49d927a58e0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\30a63a4b19eacb84cc0ac49d927a58e0_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 348
    3⤵
    - Program crash
    PID:1688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 380
    3⤵
    - Program crash
    PID:768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3688 -ip 3688
1⤵
PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2320 -ip 2320
1⤵
PID:1984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2320 -ip 2320
1⤵
PID:4192

C:\Users\Admin\AppData\Local\Temp\30a63a4b19eacb84cc0ac49d927a58e0_NeikiAnalytics.exe

Filesize
885KB

MD5
ca1ffc7912fec4527fa1f1c5790f72d2

SHA1
126759b111eef3b0d7a56497acddca212dcbbb70

SHA256
fc2f1f9229dbde8d19d38ed1c61cbf3b24ff3a069ee778d3d97733f2ce25a0cc

SHA512
09312b2eaa6cb0b8f06368ac87aff1d27a7a67769034d2c9bf0630ccb88d26b996e227bf660876a85d95c431af1d3dc8ce9e49062db8b14fef5e9b67266bb2a6

Download Submit
memory/2320-7-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2320-8-0x00000000050A0000-0x0000000005188000-memory.dmp

Filesize
928KB

Download
memory/2320-9-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/3688-0-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/3688-6-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download