ffd191cff896b31b2d2651517fd07b0cb5f32fa4ff6fbc474e0c738b7005708d

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 00:32

Target

417475366f8215f22b69487daa731710_NeikiAnalytics.exe
Size

669KB
MD5

417475366f8215f22b69487daa731710
SHA1

6292df359b9b10dbd4215d845c35449221552930
SHA256

ffd191cff896b31b2d2651517fd07b0cb5f32fa4ff6fbc474e0c738b7005708d
SHA512

07cfedc3ee8b528de2be22c49512cc7b5079b21d62cc124289f8017f929f6cfd846e676dee393c29dbec9591e7fcc7c2ab93e35d36d32aec5dcc954377fe3e5d
SSDEEP

6144:xwrGnfIRzRSPpwMHjH4ZGL3O0b83ii96AMaJB8udk4+xZRtiKzvzaOLVYg:xAGwtRSPuMHjH0GL3OB3x6Faa6g

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2056	2512	417475366f8215f22b69487daa731710_NeikiAnalytics.exe	28
PID 2512 wrote to memory of 2056	2512	417475366f8215f22b69487daa731710_NeikiAnalytics.exe	28
PID 2512 wrote to memory of 2056	2512	417475366f8215f22b69487daa731710_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\417475366f8215f22b69487daa731710_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\417475366f8215f22b69487daa731710_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2512 -s 76
  2⤵
  PID:2056