35750c3f25298d674a21ae577afd8102116cf4d367ca4df3afdae1c19dca450d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 05:25

Target

85ab68712c5ecb805538bab90864eae0_NeikiAnalytics.exe
Size

30KB
MD5

85ab68712c5ecb805538bab90864eae0
SHA1

e2cfb241f00c361bed808210639c391ad5e15161
SHA256

35750c3f25298d674a21ae577afd8102116cf4d367ca4df3afdae1c19dca450d
SHA512

c07660ae765e259039bd53b1d15880801464797de25f5553fb5df0db1694e54e8a0fb3cbe8cd3dd1a5884df5ab8e44c736aab30cde9066c0c74876a7b3ea4306
SSDEEP

384:j6t5FeWlKELzofkaP2VI46hq6ki2bix0GvHE6CjdAA1m5wM36QNuZLUUJQj:jiMEX30n3F2mxrE6Cxf1ml36QgZR4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 2368	1796	85ab68712c5ecb805538bab90864eae0_NeikiAnalytics.exe	28
PID 1796 wrote to memory of 2368	1796	85ab68712c5ecb805538bab90864eae0_NeikiAnalytics.exe	28
PID 1796 wrote to memory of 2368	1796	85ab68712c5ecb805538bab90864eae0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\85ab68712c5ecb805538bab90864eae0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\85ab68712c5ecb805538bab90864eae0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1796 -s 500
  2⤵
  PID:2368

memory/1796-0-0x000007FEF52B3000-0x000007FEF52B4000-memory.dmp

Filesize
4KB

Download
memory/1796-1-0x0000000000A50000-0x0000000000A5A000-memory.dmp

Filesize
40KB

Download
memory/1796-2-0x000007FEF52B3000-0x000007FEF52B4000-memory.dmp

Filesize
4KB

Download