88f115f037249e88ce7de01898a274e14e87dba0b318fc3ba377d31ed76dd5e1

Analysis

max time kernel
132s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 06:07

Target

88f115f037249e88ce7de01898a274e14e87dba0b318fc3ba377d31ed76dd5e1_NeikiAnalytics.exe
Size

320KB
MD5

6b5ffca9944a37a2cc4655b2603433a0
SHA1

24529bd2f6333a129c0fdc05b05adf47112e70cc
SHA256

88f115f037249e88ce7de01898a274e14e87dba0b318fc3ba377d31ed76dd5e1
SHA512

d9e5f9931a044e8d4c6ab7afcbc0a176cc5add3eeafee8bb2ba239d10108f93d393443a074c3eebf83373bae34e8601b8babc7dd032854ad966c6ded7ac80d6b
SSDEEP

6144:uhXMue9Nam9u6uwhXEI1PJoZp8QK5bzqwaiOLWkX9aLisM+NeOV40saiigCX:uhXMue9cuu6uwXOpyEiYX9aLisvNeOV9

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1840	88f115f037249e88ce7de01898a274e14e87dba0b318fc3ba377d31ed76dd5e1_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
1840	88f115f037249e88ce7de01898a274e14e87dba0b318fc3ba377d31ed76dd5e1_NeikiAnalytics.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4032	3112	WerFault.exe	91
4716	1840	WerFault.exe	97

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3112	88f115f037249e88ce7de01898a274e14e87dba0b318fc3ba377d31ed76dd5e1_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1840	88f115f037249e88ce7de01898a274e14e87dba0b318fc3ba377d31ed76dd5e1_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 1840	3112	88f115f037249e88ce7de01898a274e14e87dba0b318fc3ba377d31ed76dd5e1_NeikiAnalytics.exe	97
PID 3112 wrote to memory of 1840	3112	88f115f037249e88ce7de01898a274e14e87dba0b318fc3ba377d31ed76dd5e1_NeikiAnalytics.exe	97
PID 3112 wrote to memory of 1840	3112	88f115f037249e88ce7de01898a274e14e87dba0b318fc3ba377d31ed76dd5e1_NeikiAnalytics.exe	97

C:\Users\Admin\AppData\Local\Temp\88f115f037249e88ce7de01898a274e14e87dba0b318fc3ba377d31ed76dd5e1_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\88f115f037249e88ce7de01898a274e14e87dba0b318fc3ba377d31ed76dd5e1_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 396
  2⤵
  - Program crash
  PID:4032
- C:\Users\Admin\AppData\Local\Temp\88f115f037249e88ce7de01898a274e14e87dba0b318fc3ba377d31ed76dd5e1_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\88f115f037249e88ce7de01898a274e14e87dba0b318fc3ba377d31ed76dd5e1_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 368
    3⤵
    - Program crash
    PID:4716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3112 -ip 3112
1⤵
PID:3676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1840 -ip 1840
1⤵
PID:3756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4308,i,3671441404766730751,12082497324212183132,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
1⤵
PID:3060

C:\Users\Admin\AppData\Local\Temp\88f115f037249e88ce7de01898a274e14e87dba0b318fc3ba377d31ed76dd5e1_NeikiAnalytics.exe

Filesize
320KB

MD5
1cdebf7a13ec1b6d85dafe4c382f99c6

SHA1
0223b6f330adf443efe6c8be683a27315886efe6

SHA256
80307c2015021e1dc30ce064b7e71597a53d8b02750634da11ea9d5030a03166

SHA512
13892ae3a766fa426aa4d5a8bdb27238bf91c42d0ca731a37b3e483ffdf1cb975399fcf85a169ca0bf7ae2fd2c50b18cd20c19847685dac253a75b47d92b13f4

Download Submit
memory/1840-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1840-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1840-13-0x00000000014D0000-0x0000000001512000-memory.dmp

Filesize
264KB

Download
memory/3112-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3112-6-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download