938a6292bc64c254ba47eb097835c43a40b201f8c8664c0128ea0476ce007666

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 15:24

Target

bd4bc1176b6357133f68b33518dc2620_NeikiAnalytics.exe
Size

1.0MB
MD5

bd4bc1176b6357133f68b33518dc2620
SHA1

85388a39abfe37c87a4b7bb761d2ead4a7e53bc8
SHA256

938a6292bc64c254ba47eb097835c43a40b201f8c8664c0128ea0476ce007666
SHA512

0a0e3e128ce2565c57dcaecad92a14821700d4c1ab6783de8ec8db6bac970ad7514e46221971b08c0b8887054483bfe3aaa3d7009956e5ada6ccf64922a3654a
SSDEEP

24576:VAiJ2jHOiD5S8QWHMqjfXlg4dKOhSi1tmd7edXAomgu/p:mjHpfQmMqJZdKOQymBexk/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2656	1668	bd4bc1176b6357133f68b33518dc2620_NeikiAnalytics.exe	29
PID 1668 wrote to memory of 2656	1668	bd4bc1176b6357133f68b33518dc2620_NeikiAnalytics.exe	29
PID 1668 wrote to memory of 2656	1668	bd4bc1176b6357133f68b33518dc2620_NeikiAnalytics.exe	29

C:\Users\Admin\AppData\Local\Temp\bd4bc1176b6357133f68b33518dc2620_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\bd4bc1176b6357133f68b33518dc2620_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1668 -s 520
  2⤵
  PID:2656

memory/1668-0-0x000007FEF5EA3000-0x000007FEF5EA4000-memory.dmp

Filesize
4KB

Download
memory/1668-1-0x00000000013A0000-0x00000000014B2000-memory.dmp

Filesize
1.1MB

Download
memory/1668-2-0x000007FEF5EA3000-0x000007FEF5EA4000-memory.dmp

Filesize
4KB

Download