0b2a7cb3ba55e592d3eff200ddfedea331223260607e0d81e6bd1b00caaf9f31

Analysis

max time kernel
136s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 21:34

Target

0b2a7cb3ba55e592d3eff200ddfedea331223260607e0d81e6bd1b00caaf9f31_NeikiAnalytics.exe
Size

89KB
MD5

01754c2c2dec8267e5cc92dacbf89b10
SHA1

48f3927e55604147076ca8ddcf4cd1457e49b27e
SHA256

0b2a7cb3ba55e592d3eff200ddfedea331223260607e0d81e6bd1b00caaf9f31
SHA512

7a0d39bc076a4d1901538cc0fa18be2f239dedf0632684d08600d588685305fe9f29e410e6300056fb625521f89acd70de3c233dc8d08c014714326a1ccc94a5
SSDEEP

1536:F9o65gQK3Zm+Mt9RV5O8oQ9cXFunGm6ManhFLnBqHan6owwosTk8vxA:F9o6fK2XqXQwhnHlqQo8Lvy

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4548 1428 WerFault.exe winver.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

winver.exe

pid process

1428 winver.exe
1428 winver.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Explorer.EXE

description pid process

Token: SeShutdownPrivilege 3492 Explorer.EXE
Token: SeCreatePagefilePrivilege 3492 Explorer.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

winver.exe

pid process

1428 winver.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3492 Explorer.EXE

pid	pid_target	process	target process
4548	1428	WerFault.exe	winver.exe

pid	process
1428	winver.exe
1428	winver.exe

description	pid	process
Token: SeShutdownPrivilege	3492	Explorer.EXE
Token: SeCreatePagefilePrivilege	3492	Explorer.EXE

pid	process
1428	winver.exe

pid	process
3492	Explorer.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

0b2a7cb3ba55e592d3eff200ddfedea331223260607e0d81e6bd1b00caaf9f31_NeikiAnalytics.exewinver.exe

description	pid	process	target process
PID 1532 wrote to memory of 1428	1532	0b2a7cb3ba55e592d3eff200ddfedea331223260607e0d81e6bd1b00caaf9f31_NeikiAnalytics.exe	winver.exe
PID 1532 wrote to memory of 1428	1532	0b2a7cb3ba55e592d3eff200ddfedea331223260607e0d81e6bd1b00caaf9f31_NeikiAnalytics.exe	winver.exe
PID 1532 wrote to memory of 1428	1532	0b2a7cb3ba55e592d3eff200ddfedea331223260607e0d81e6bd1b00caaf9f31_NeikiAnalytics.exe	winver.exe
PID 1532 wrote to memory of 1428	1532	0b2a7cb3ba55e592d3eff200ddfedea331223260607e0d81e6bd1b00caaf9f31_NeikiAnalytics.exe	winver.exe
PID 1428 wrote to memory of 3492	1428	winver.exe	Explorer.EXE
PID 1428 wrote to memory of 2532	1428	winver.exe	sihost.exe

C:\Users\Admin\AppData\Local\Temp\0b2a7cb3ba55e592d3eff200ddfedea331223260607e0d81e6bd1b00caaf9f31_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0b2a7cb3ba55e592d3eff200ddfedea331223260607e0d81e6bd1b00caaf9f31_NeikiAnalytics.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 632
4⤵
- Program crash
PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1428 -ip 1428
1⤵
PID:4368

memory/1428-8-0x00007FFFB8FF0000-0x00007FFFB91E5000-memory.dmp

Filesize
2.0MB

Download
memory/1428-14-0x0000000000B30000-0x0000000000B36000-memory.dmp

Filesize
24KB

Download
memory/1428-2-0x0000000000B30000-0x0000000000B36000-memory.dmp

Filesize
24KB

Download
memory/1428-6-0x0000000077C92000-0x0000000077C93000-memory.dmp

Filesize
4KB

Download
memory/1532-10-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1532-5-0x0000000002360000-0x0000000002D60000-memory.dmp

Filesize
10.0MB

Download
memory/1532-0-0x00000000009D0000-0x00000000009D2000-memory.dmp

Filesize
8KB

Download
memory/1532-13-0x0000000002360000-0x0000000002D60000-memory.dmp

Filesize
10.0MB

Download
memory/2532-12-0x0000000000C60000-0x0000000000C66000-memory.dmp

Filesize
24KB

Download
memory/2532-11-0x0000000000C60000-0x0000000000C66000-memory.dmp

Filesize
24KB

Download
memory/2532-16-0x00007FFFB9210000-0x00007FFFB9211000-memory.dmp

Filesize
4KB

Download
memory/3492-7-0x00007FFFB908D000-0x00007FFFB908E000-memory.dmp

Filesize
4KB

Download
memory/3492-1-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/3492-9-0x00007FFFB9220000-0x00007FFFB9221000-memory.dmp

Filesize
4KB

Download
memory/3492-4-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download