ead81408417b13c86b4d694db8dc5771d13e6ca25780276759fd37b0b6918e0b

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 20:45

Target

75a779979bca45b0accbf31d7d512270_NeikiAnalytics.exe
Size

27KB
MD5

75a779979bca45b0accbf31d7d512270
SHA1

d8c5165473bc98abcdccca178a5a948a49056b19
SHA256

ead81408417b13c86b4d694db8dc5771d13e6ca25780276759fd37b0b6918e0b
SHA512

415e44cb2ac2365eeca07f7960afceea4e8526695ad2d9aca67163a9b60af3d41d49caa9d4007870cbf37eedc6bb27c6cfc78a364ab269adaaa542fbe4fbc8e0
SSDEEP

384:J+hvz6Sf/sDcgPF1Q+ArSyDV25ITKt4SiClEVxWXnWjuMa2ACx2x:J+ZGS8DL1clC/XWjut3Ca

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2220	1680	75a779979bca45b0accbf31d7d512270_NeikiAnalytics.exe	29
PID 1680 wrote to memory of 2220	1680	75a779979bca45b0accbf31d7d512270_NeikiAnalytics.exe	29
PID 1680 wrote to memory of 2220	1680	75a779979bca45b0accbf31d7d512270_NeikiAnalytics.exe	29

C:\Users\Admin\AppData\Local\Temp\75a779979bca45b0accbf31d7d512270_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\75a779979bca45b0accbf31d7d512270_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1680 -s 496
  2⤵
  PID:2220

memory/1680-0-0x000007FEF5A43000-0x000007FEF5A44000-memory.dmp

Filesize
4KB

Download
memory/1680-1-0x0000000000310000-0x000000000031E000-memory.dmp

Filesize
56KB

Download
memory/1680-2-0x000007FEF5A43000-0x000007FEF5A44000-memory.dmp

Filesize
4KB

Download