2d94efc81e42b2c2424eb6d7893271c67f0fcc3ceb33766ff12029b636db3b38

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 22:10

Target

489aa69d22acc51f5b7161840cf40f40_NeikiAnalytics.exe
Size

133KB
MD5

489aa69d22acc51f5b7161840cf40f40
SHA1

5ecafafe2fdd6aefbd9b4de054357e4fd4b001e0
SHA256

2d94efc81e42b2c2424eb6d7893271c67f0fcc3ceb33766ff12029b636db3b38
SHA512

1b235c8ea57d3c7a1c33f8e45633d18268819e6851306f1f8dfc177226a4bca1d00ecab9f74006592ff8ed319c8f80d63440c648a4e1275ddc25b37cddcfd4cc
SSDEEP

1536:DeT7BVwxfvcguKfmy0KQbj6vbjuKoauGi4X:DmVwRUE+y0KUj6TjR9i4X

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2360 1960 WerFault.exe 489aa69d22acc51f5b7161840cf40f40_NeikiAnalytics.exe

pid	pid_target	process	target process
2360	1960	WerFault.exe	489aa69d22acc51f5b7161840cf40f40_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

489aa69d22acc51f5b7161840cf40f40_NeikiAnalytics.exe

description	pid	process	target process
PID 1960 wrote to memory of 2360	1960	489aa69d22acc51f5b7161840cf40f40_NeikiAnalytics.exe	WerFault.exe
PID 1960 wrote to memory of 2360	1960	489aa69d22acc51f5b7161840cf40f40_NeikiAnalytics.exe	WerFault.exe
PID 1960 wrote to memory of 2360	1960	489aa69d22acc51f5b7161840cf40f40_NeikiAnalytics.exe	WerFault.exe
PID 1960 wrote to memory of 2360	1960	489aa69d22acc51f5b7161840cf40f40_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\489aa69d22acc51f5b7161840cf40f40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\489aa69d22acc51f5b7161840cf40f40_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 36
  2⤵
  - Program crash
  PID:2360