0469f50854f0dde4fe6c3f21ce5718f8fce4d93b7c7f5c3d87a3be63cf8c8ca4

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 21:13

Target

3d0cf751fb32bf70ed4f71aabebb3510_NeikiAnalytics.exe
Size

1.6MB
MD5

3d0cf751fb32bf70ed4f71aabebb3510
SHA1

9cb2daa219930db66e9fbc0fdbd163b9ea530176
SHA256

0469f50854f0dde4fe6c3f21ce5718f8fce4d93b7c7f5c3d87a3be63cf8c8ca4
SHA512

00f5087887146714b6d0e4c7db9eafe272acf590046a2ddba359c4cebda16ce8b64ec88095bdb5887e16546af9df255a30f9da1fc16862884638b75d5b23ad1b
SSDEEP

49152:rjxgaz5WITYbNbNWo4kSH3OqtwIDYaRQ:HCazgIT4bNJFY3Oqt3Ye

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

3d0cf751fb32bf70ed4f71aabebb3510_NeikiAnalytics.exe

description	pid	process	target process
PID 2196 wrote to memory of 1712	2196	3d0cf751fb32bf70ed4f71aabebb3510_NeikiAnalytics.exe	WerFault.exe
PID 2196 wrote to memory of 1712	2196	3d0cf751fb32bf70ed4f71aabebb3510_NeikiAnalytics.exe	WerFault.exe
PID 2196 wrote to memory of 1712	2196	3d0cf751fb32bf70ed4f71aabebb3510_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3d0cf751fb32bf70ed4f71aabebb3510_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3d0cf751fb32bf70ed4f71aabebb3510_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2196

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2196 -s 532
2⤵
PID:1712

memory/2196-0-0x000007FEF5833000-0x000007FEF5834000-memory.dmp

Filesize
4KB

Download
memory/2196-1-0x0000000000820000-0x00000000009C8000-memory.dmp

Filesize
1.7MB

Download
memory/2196-2-0x000007FEF5833000-0x000007FEF5834000-memory.dmp

Filesize
4KB

Download