5d237a5475709c2a56954ad5dcdce9bea361362f1674d7b9e2bb1e2fa272124c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 06:50

Target

c978e7c4a206342fd71718c8dbce43d0_NeikiAnalytics.exe
Size

861KB
MD5

c978e7c4a206342fd71718c8dbce43d0
SHA1

6906fea7113f2164d17627cc876bd2315199d173
SHA256

5d237a5475709c2a56954ad5dcdce9bea361362f1674d7b9e2bb1e2fa272124c
SHA512

0eac8ecaf51706f279e990253232e8ab18d897a9891e7b634ffd377738399299a36e05c9a5281652ab3fce0c3dfd9e0238dfb3177abe5de1d88769354f73af9a
SSDEEP

12288:+hvBaUf7B4TjHNNQZ5xdqbaFTkiA8Ds5h+yXHYGtYLgItdqkjHNNQZ5xdqbaFTkJ:tcV4FMYbaFTkieOyXXYLgKMYbaFTki

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2656	1904	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2656	1904	c978e7c4a206342fd71718c8dbce43d0_NeikiAnalytics.exe	28
PID 1904 wrote to memory of 2656	1904	c978e7c4a206342fd71718c8dbce43d0_NeikiAnalytics.exe	28
PID 1904 wrote to memory of 2656	1904	c978e7c4a206342fd71718c8dbce43d0_NeikiAnalytics.exe	28
PID 1904 wrote to memory of 2656	1904	c978e7c4a206342fd71718c8dbce43d0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\c978e7c4a206342fd71718c8dbce43d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c978e7c4a206342fd71718c8dbce43d0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 532
  2⤵
  - Program crash
  PID:2656

memory/1904-0-0x00000000740DE000-0x00000000740DF000-memory.dmp

Filesize
4KB

Download
memory/1904-1-0x0000000001100000-0x00000000011DE000-memory.dmp

Filesize
888KB

Download
memory/1904-2-0x00000000740DE000-0x00000000740DF000-memory.dmp

Filesize
4KB

Download