c27f609ec005ae301dc7c1ec1a37961fd20c512bf9975ba4e30ee043d70a0b5e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:39

Target

63e8062c25e93de90ceed686186d0c70_NeikiAnalytics.exe
Size

15KB
MD5

63e8062c25e93de90ceed686186d0c70
SHA1

ecce885c4f6032c3a5abcc6e657b7d40037df492
SHA256

c27f609ec005ae301dc7c1ec1a37961fd20c512bf9975ba4e30ee043d70a0b5e
SHA512

391708d732bcb8a333d366982485e82d377ea9b4d6fda6cc12e1bf610eb9fcd32932700ab07678cb349a8aee32ad4efff80f9476bab5a341f9f008e76b800584
SSDEEP

384:Op5cqkqfInSoHr7iydC8QbWPT9xu1y6rQS6hS6:Op5cqksI5reyo8QiPHB6rQNA6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2180 1504 WerFault.exe 63e8062c25e93de90ceed686186d0c70_NeikiAnalytics.exe

pid	pid_target	process	target process
2180	1504	WerFault.exe	63e8062c25e93de90ceed686186d0c70_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

63e8062c25e93de90ceed686186d0c70_NeikiAnalytics.exe

description	pid	process	target process
PID 1504 wrote to memory of 2180	1504	63e8062c25e93de90ceed686186d0c70_NeikiAnalytics.exe	WerFault.exe
PID 1504 wrote to memory of 2180	1504	63e8062c25e93de90ceed686186d0c70_NeikiAnalytics.exe	WerFault.exe
PID 1504 wrote to memory of 2180	1504	63e8062c25e93de90ceed686186d0c70_NeikiAnalytics.exe	WerFault.exe
PID 1504 wrote to memory of 2180	1504	63e8062c25e93de90ceed686186d0c70_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\63e8062c25e93de90ceed686186d0c70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\63e8062c25e93de90ceed686186d0c70_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 540
2⤵
- Program crash
PID:2180

memory/1504-0-0x00000000743DE000-0x00000000743DF000-memory.dmp

Filesize
4KB

Download
memory/1504-1-0x0000000000030000-0x000000000003A000-memory.dmp

Filesize
40KB

Download
memory/1504-2-0x00000000743DE000-0x00000000743DF000-memory.dmp

Filesize
4KB

Download