44379bcc7134e93b731114f4aee0146df1077518f19ca2f4ddbc9621cc4071ef

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 08:43

Target

44379bcc7134e93b731114f4aee0146df1077518f19ca2f4ddbc9621cc4071ef_NeikiAnalytics.exe
Size

4.6MB
MD5

c3b39653ada371713dcedd26faf41b00
SHA1

421aa0265835faccba33dc1c6a254bb76e689fc3
SHA256

44379bcc7134e93b731114f4aee0146df1077518f19ca2f4ddbc9621cc4071ef
SHA512

89cd069f77e84b4b610970a9312cf69594e49dd578c6bcab0ac1bf47974ad8ae07e8fa9eb724b9f91b35a0c4ab44ebb9d80c1759b20fffb5f62965388677e3ba
SSDEEP

24576:HScwwba/ZS2JovBYzJLVxZITvKMMMvQAM2BYRcBoA1/LhAggkesqOBGhefUjZY+o:HFwWgnLqrXgiYAqxeHg4LqrXgtQe

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2060	44379bcc7134e93b731114f4aee0146df1077518f19ca2f4ddbc9621cc4071ef_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2060	44379bcc7134e93b731114f4aee0146df1077518f19ca2f4ddbc9621cc4071ef_NeikiAnalytics.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1844	4660	WerFault.exe	88
4988	2060	WerFault.exe	93
688	2060	WerFault.exe	93

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4660	44379bcc7134e93b731114f4aee0146df1077518f19ca2f4ddbc9621cc4071ef_NeikiAnalytics.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2060	44379bcc7134e93b731114f4aee0146df1077518f19ca2f4ddbc9621cc4071ef_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 2060	4660	44379bcc7134e93b731114f4aee0146df1077518f19ca2f4ddbc9621cc4071ef_NeikiAnalytics.exe	93
PID 4660 wrote to memory of 2060	4660	44379bcc7134e93b731114f4aee0146df1077518f19ca2f4ddbc9621cc4071ef_NeikiAnalytics.exe	93
PID 4660 wrote to memory of 2060	4660	44379bcc7134e93b731114f4aee0146df1077518f19ca2f4ddbc9621cc4071ef_NeikiAnalytics.exe	93

C:\Users\Admin\AppData\Local\Temp\44379bcc7134e93b731114f4aee0146df1077518f19ca2f4ddbc9621cc4071ef_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\44379bcc7134e93b731114f4aee0146df1077518f19ca2f4ddbc9621cc4071ef_NeikiAnalytics.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 344
  2⤵
  - Program crash
  PID:1844
- C:\Users\Admin\AppData\Local\Temp\44379bcc7134e93b731114f4aee0146df1077518f19ca2f4ddbc9621cc4071ef_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\44379bcc7134e93b731114f4aee0146df1077518f19ca2f4ddbc9621cc4071ef_NeikiAnalytics.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 344
    3⤵
    - Program crash
    PID:4988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 344
    3⤵
    - Program crash
    PID:688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4660 -ip 4660
1⤵
PID:3620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2060 -ip 2060
1⤵
PID:2852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2060 -ip 2060
1⤵
PID:856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:324

C:\Users\Admin\AppData\Local\Temp\44379bcc7134e93b731114f4aee0146df1077518f19ca2f4ddbc9621cc4071ef_NeikiAnalytics.exe

Filesize
4.6MB

MD5
36b356ce0ee6861871ea2cf6c8a98a3e

SHA1
94c888e8c916a95438bbd8501311e075bef604af

SHA256
0ca6e75fb198bd000f887f50f893542e75bc1f67b44a62113871207f2f2e3118

SHA512
c72e2d0e1637aad504e7daea9a6a996820f35a86ea5d74b5d3db2df3e35bc48f32a8164acaef732ea1bc825349edfdc7060e79b98796ebec2186b9d0450d4b55

Download Submit
memory/2060-7-0x0000000000400000-0x00000000004EE000-memory.dmp

Filesize
952KB

Download
memory/2060-8-0x0000000005080000-0x000000000516E000-memory.dmp

Filesize
952KB

Download
memory/2060-9-0x0000000000400000-0x00000000004A3000-memory.dmp

Filesize
652KB

Download
memory/4660-0-0x0000000000400000-0x00000000004EE000-memory.dmp

Filesize
952KB

Download
memory/4660-6-0x0000000000400000-0x00000000004EE000-memory.dmp

Filesize
952KB

Download