fe8e3867ef5e09395d5b32902799952d742b62cc4815822bb875e07ddd04b139

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 03:27

Target

5ce44d576a6d647633f10dce8a304cd0_NeikiAnalytics.exe
Size

115KB
MD5

5ce44d576a6d647633f10dce8a304cd0
SHA1

347ce2fa5fad2eb0d04516af2bfa51236de62839
SHA256

fe8e3867ef5e09395d5b32902799952d742b62cc4815822bb875e07ddd04b139
SHA512

9fbf3e8b12923433dffdb58d36496b473c6ba7f09f272062cdf32e9f390d659aca12f658e9d345fd42fc06ba4f90f28aa40604dcd807fd90a11a50830c932aec
SSDEEP

3072:jB4p36VGmEdm0wDWrP+MmEbjBkMqhGKZTbzsRg:jNpEdmpDWJ3ibZL+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1300	2028	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1300	2028	5ce44d576a6d647633f10dce8a304cd0_NeikiAnalytics.exe	28
PID 2028 wrote to memory of 1300	2028	5ce44d576a6d647633f10dce8a304cd0_NeikiAnalytics.exe	28
PID 2028 wrote to memory of 1300	2028	5ce44d576a6d647633f10dce8a304cd0_NeikiAnalytics.exe	28
PID 2028 wrote to memory of 1300	2028	5ce44d576a6d647633f10dce8a304cd0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\5ce44d576a6d647633f10dce8a304cd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5ce44d576a6d647633f10dce8a304cd0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 36
  2⤵
  - Program crash
  PID:1300

memory/2028-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download