1d048f24546ce3de911d97b82287860ddff41d3a8e3ec36b0809e232ce3aceb0

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 04:29

Target

a76cac106e5dbb0d11aa709968e06b60_NeikiAnalytics.exe
Size

72KB
MD5

a76cac106e5dbb0d11aa709968e06b60
SHA1

473ccb56fc3bcaba74f23bd14babf442ebbdf121
SHA256

1d048f24546ce3de911d97b82287860ddff41d3a8e3ec36b0809e232ce3aceb0
SHA512

1163d550734c44493dc72c57f81e6142d8bbc638a07ec544d0a788f9bd00d54810fab98020dcddd4bb71bd59703371768d1e0a13627e38bd451ef6a66a6f3426
SSDEEP

1536:IqBT5sq6bHcXchS8oW/ljZQM6p0/iMb+KR0Nc8QsJq39:dBTx6wXwp5M70/ie0Nc8QsC9

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

908 3056 WerFault.exe a76cac106e5dbb0d11aa709968e06b60_NeikiAnalytics.exe

pid	pid_target	process	target process
908	3056	WerFault.exe	a76cac106e5dbb0d11aa709968e06b60_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a76cac106e5dbb0d11aa709968e06b60_NeikiAnalytics.exe

description	pid	process	target process
PID 3056 wrote to memory of 908	3056	a76cac106e5dbb0d11aa709968e06b60_NeikiAnalytics.exe	WerFault.exe
PID 3056 wrote to memory of 908	3056	a76cac106e5dbb0d11aa709968e06b60_NeikiAnalytics.exe	WerFault.exe
PID 3056 wrote to memory of 908	3056	a76cac106e5dbb0d11aa709968e06b60_NeikiAnalytics.exe	WerFault.exe
PID 3056 wrote to memory of 908	3056	a76cac106e5dbb0d11aa709968e06b60_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a76cac106e5dbb0d11aa709968e06b60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a76cac106e5dbb0d11aa709968e06b60_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 64
2⤵
- Program crash
PID:908