7d89bbed77adfd9899815d73d42a00fbbf73776e8dd68f21e644d895945e7bf2

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:56

Target

13dd1522c3af5476e9a7df41b8f31620_NeikiAnalytics.exe
Size

123KB
MD5

13dd1522c3af5476e9a7df41b8f31620
SHA1

41aca1b5328dfd2035a112cabbb973a81e0b9a18
SHA256

7d89bbed77adfd9899815d73d42a00fbbf73776e8dd68f21e644d895945e7bf2
SHA512

534206f678aeefde24cba64916af67e967e26f41a4ffd42929643c545eef7b4dfdd5fa2b2e77187574e941cd07bc3a548dd3a15abb74b71a4394508d1d4535d3
SSDEEP

1536:DeT7BVwxfv6guKbGADzVgQ19/RfTO0UiDH1r:DmVwRSEbdDxxvLHUE

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1952 2880 WerFault.exe 13dd1522c3af5476e9a7df41b8f31620_NeikiAnalytics.exe

pid	pid_target	process	target process
1952	2880	WerFault.exe	13dd1522c3af5476e9a7df41b8f31620_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

13dd1522c3af5476e9a7df41b8f31620_NeikiAnalytics.exe

description	pid	process	target process
PID 2880 wrote to memory of 1952	2880	13dd1522c3af5476e9a7df41b8f31620_NeikiAnalytics.exe	WerFault.exe
PID 2880 wrote to memory of 1952	2880	13dd1522c3af5476e9a7df41b8f31620_NeikiAnalytics.exe	WerFault.exe
PID 2880 wrote to memory of 1952	2880	13dd1522c3af5476e9a7df41b8f31620_NeikiAnalytics.exe	WerFault.exe
PID 2880 wrote to memory of 1952	2880	13dd1522c3af5476e9a7df41b8f31620_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\13dd1522c3af5476e9a7df41b8f31620_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\13dd1522c3af5476e9a7df41b8f31620_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 36
2⤵
- Program crash
PID:1952