1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 01:11

Target

1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe
Size

202KB
MD5

0ba028b2b966fd1554e0b6aaffa0c030
SHA1

ee7d318e2dfa3f3ea9b5dd74e0cffa8904d54c07
SHA256

1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4
SHA512

3fcf438fd91dc9c30b99400037c4a0b57ca35c49ba3531f4d8910d67d2dc9a18c449de2c4834256cd7fb28b151730dcdf1d461f464fbf7c295d71f2e857c7992
SSDEEP

6144:Oes5Hl4Bb/rW6YboPFaNozVfDNqyyxZLcq6Qowd4YodgEixBkrP:TBrWpoPFaNoZfDNqyoZLcqdowd4YoViq

Score

7^/10

Deletes itself 1 IoCs

pid	Process
3100	1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
3100	1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3160	2420	WerFault.exe	80
3604	3100	WerFault.exe	85

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2420	1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3100	1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 3100	2420	1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe	85
PID 2420 wrote to memory of 3100	2420	1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe	85
PID 2420 wrote to memory of 3100	2420	1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe	85

C:\Users\Admin\AppData\Local\Temp\1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 396
  2⤵
  - Program crash
  PID:3160
- C:\Users\Admin\AppData\Local\Temp\1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 364
    3⤵
    - Program crash
    PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2420 -ip 2420
1⤵
PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3100 -ip 3100
1⤵
PID:2396

C:\Users\Admin\AppData\Local\Temp\1b1cc7b95b2f0e128e3d3d509b8a3a963bd8b9d854a1cc5d0d199ba74d18faa4_NeikiAnalytics.exe

Filesize
202KB

MD5
8a085771fc39b075ade0910c36739d2c

SHA1
f459862c891b7e3df8859de0dab51514410f518d

SHA256
914433890f901006752e6e855eaa432c329a87ca3d419372e36813268991d1b8

SHA512
f6c5609f55edea4b0ee1d8f80337e7a1d2cafb675d5377ed1adc7a58d00eef276e3a2cdf56046304b8ca2bd9021f347bac8947da79547708cc8143f013b9dc16

Download Submit
memory/2420-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2420-6-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3100-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3100-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3100-13-0x00000000014A0000-0x00000000014DE000-memory.dmp

Filesize
248KB

Download
memory/3100-14-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download