4cc39581a4275801532b9ddd108cdfa467674025461dbaa9d19e5fb9f33b2a1b

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 12:39

Target

4cc39581a4275801532b9ddd108cdfa467674025461dbaa9d19e5fb9f33b2a1b_NeikiAnalytics.exe
Size

669KB
MD5

cd4b4f7227a14d86d3073f85c0c70dd0
SHA1

7bb8ccaf9f8c8b1e670b26e88290cf650a87160e
SHA256

4cc39581a4275801532b9ddd108cdfa467674025461dbaa9d19e5fb9f33b2a1b
SHA512

333f9006bd12680d5715ec2f80ed3744e8fc4ccce730f671cc4a30b552f9d1aefec6f65f1e046a426514443dcb38fe51f5257b25e59af551b5db89d20d4e2f28
SSDEEP

6144:xwrGnfIRzRSPpwMHjH4ZGL3O0b83ii96AMaJB8udk4+xZRtiKzvzaOLVYa:xAGwtRSPuMHjH0GL3OB3x6Faa6a

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4cc39581a4275801532b9ddd108cdfa467674025461dbaa9d19e5fb9f33b2a1b_NeikiAnalytics.exe

description	pid	process	target process
PID 1636 wrote to memory of 2220	1636	4cc39581a4275801532b9ddd108cdfa467674025461dbaa9d19e5fb9f33b2a1b_NeikiAnalytics.exe	WerFault.exe
PID 1636 wrote to memory of 2220	1636	4cc39581a4275801532b9ddd108cdfa467674025461dbaa9d19e5fb9f33b2a1b_NeikiAnalytics.exe	WerFault.exe
PID 1636 wrote to memory of 2220	1636	4cc39581a4275801532b9ddd108cdfa467674025461dbaa9d19e5fb9f33b2a1b_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4cc39581a4275801532b9ddd108cdfa467674025461dbaa9d19e5fb9f33b2a1b_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4cc39581a4275801532b9ddd108cdfa467674025461dbaa9d19e5fb9f33b2a1b_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1636 -s 76
2⤵
PID:2220