3b395a9d62eb7b72eaf6190fb76a688956abfbe10cbd278bd44b9c29d29ea5d2

Analysis

max time kernel
93s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 06:14

Target

3b395a9d62eb7b72eaf6190fb76a688956abfbe10cbd278bd44b9c29d29ea5d2_NeikiAnalytics.exe
Size

333KB
MD5

d2dada673a2221599a50c40b9826b210
SHA1

ea5906dc6804c784677e2855e2c22f77a3b7d59c
SHA256

3b395a9d62eb7b72eaf6190fb76a688956abfbe10cbd278bd44b9c29d29ea5d2
SHA512

7fed763f81c12493874bd81f8ff2a422ceb09f680bb40278e2b8e00d9c4becfe219c128d4a059c2abfb4d3e43ee5c92488037aa9a1f330ae177abd09d4b87330
SSDEEP

6144:rkcgf99HMDHyx5J22weaduZRNTHMpXh5v2ZifCKLNm7pMsJzAWO9yy6atBWONLRT:r5KHMDHyx5J22weaduZRNTHMJTv2ZeY6

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1344	3b395a9d62eb7b72eaf6190fb76a688956abfbe10cbd278bd44b9c29d29ea5d2_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
1344	3b395a9d62eb7b72eaf6190fb76a688956abfbe10cbd278bd44b9c29d29ea5d2_NeikiAnalytics.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2172	2304	WerFault.exe	81
2308	1344	WerFault.exe	86

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2304	3b395a9d62eb7b72eaf6190fb76a688956abfbe10cbd278bd44b9c29d29ea5d2_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1344	3b395a9d62eb7b72eaf6190fb76a688956abfbe10cbd278bd44b9c29d29ea5d2_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 1344	2304	3b395a9d62eb7b72eaf6190fb76a688956abfbe10cbd278bd44b9c29d29ea5d2_NeikiAnalytics.exe	86
PID 2304 wrote to memory of 1344	2304	3b395a9d62eb7b72eaf6190fb76a688956abfbe10cbd278bd44b9c29d29ea5d2_NeikiAnalytics.exe	86
PID 2304 wrote to memory of 1344	2304	3b395a9d62eb7b72eaf6190fb76a688956abfbe10cbd278bd44b9c29d29ea5d2_NeikiAnalytics.exe	86

C:\Users\Admin\AppData\Local\Temp\3b395a9d62eb7b72eaf6190fb76a688956abfbe10cbd278bd44b9c29d29ea5d2_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3b395a9d62eb7b72eaf6190fb76a688956abfbe10cbd278bd44b9c29d29ea5d2_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 400
  2⤵
  - Program crash
  PID:2172
- C:\Users\Admin\AppData\Local\Temp\3b395a9d62eb7b72eaf6190fb76a688956abfbe10cbd278bd44b9c29d29ea5d2_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\3b395a9d62eb7b72eaf6190fb76a688956abfbe10cbd278bd44b9c29d29ea5d2_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 364
    3⤵
    - Program crash
    PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2304 -ip 2304
1⤵
PID:3188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1344 -ip 1344
1⤵
PID:3876

C:\Users\Admin\AppData\Local\Temp\3b395a9d62eb7b72eaf6190fb76a688956abfbe10cbd278bd44b9c29d29ea5d2_NeikiAnalytics.exe

Filesize
333KB

MD5
29fe4762ab0b16a4c6b4789cf9de83dc

SHA1
384beb9ccb85326b62bd723832b853c15eec99f3

SHA256
8111637189bf249749aa120c7d626ca7f54f9699acaebc458187bab7c10811cd

SHA512
73cb4d7cd3887c34421ab2fe11c2324872f4fef834f14fa9818a5e2c41820c0634e8df071bf6dc5ebe38607d4ec82b0f51cb994775322901524bf615123702d8

Download Submit
memory/1344-8-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1344-14-0x0000000003DE0000-0x0000000003E18000-memory.dmp

Filesize
224KB

Download
memory/1344-9-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2304-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2304-6-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download