40d7b968c508404f5662be724451d457e221b27efb9302e4be257f3b1972520b

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 23:14

Target

d10a0a44ac668ad4e159c16ece7593a0_NeikiAnalytics.exe
Size

65KB
MD5

d10a0a44ac668ad4e159c16ece7593a0
SHA1

b96d58ddea48243df9779c831b36d0a97c3bd09b
SHA256

40d7b968c508404f5662be724451d457e221b27efb9302e4be257f3b1972520b
SHA512

e14cef7e8fedc34312aadb42156cd8b11a54fcfa6cd898ba20d2fbb571e8cb38d12a009ccb08e30d5d90bfd4af8fbf00ce3f908307e845cee1e0ad0c6551f9d0
SSDEEP

1536:L0c6Ya6M53imDfW991QQ5dSoBxYRwr30Fpb+4D5K3TPVXOD:oc6Yar5u1Q0CCcpS4gU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1244	2928	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 1244	2928	d10a0a44ac668ad4e159c16ece7593a0_NeikiAnalytics.exe	28
PID 2928 wrote to memory of 1244	2928	d10a0a44ac668ad4e159c16ece7593a0_NeikiAnalytics.exe	28
PID 2928 wrote to memory of 1244	2928	d10a0a44ac668ad4e159c16ece7593a0_NeikiAnalytics.exe	28
PID 2928 wrote to memory of 1244	2928	d10a0a44ac668ad4e159c16ece7593a0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\d10a0a44ac668ad4e159c16ece7593a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d10a0a44ac668ad4e159c16ece7593a0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 88
  2⤵
  - Program crash
  PID:1244

memory/2928-0-0x0000000014D00000-0x0000000014D26390-memory.dmp

Filesize
152KB

Download
memory/2928-1-0x0000000014D1D000-0x0000000014D25000-memory.dmp

Filesize
32KB

Download