857a856cb1b2698b79839b1fd446178d19b179fffeb8e33ab150495ca87492a1

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 00:10

Target

9905d7462bc9624d11151947fc753ce0_NeikiAnalytics.exe
Size

1.4MB
MD5

9905d7462bc9624d11151947fc753ce0
SHA1

a57832fdc1e899ce1c093e6733468710132be391
SHA256

857a856cb1b2698b79839b1fd446178d19b179fffeb8e33ab150495ca87492a1
SHA512

0dc21a8ccb49beace8885a16c289c2aafaed0599354a804f9a9031d0068b2209369ff9ee66a831ad9d28e9ead42c789b7c47385860d1454a9c8712fc8e28a199
SSDEEP

24576:yn25nPkW3amy8sQxeWcktTjbJ47auDyEEEEEEEEEEEEEEEEEEEETKKKKKKKKKKKr:yn2kGy7wTjbO/DyEEEEEEEEEEEEEEEEm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2264	2040	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2264	2040	9905d7462bc9624d11151947fc753ce0_NeikiAnalytics.exe	30
PID 2040 wrote to memory of 2264	2040	9905d7462bc9624d11151947fc753ce0_NeikiAnalytics.exe	30
PID 2040 wrote to memory of 2264	2040	9905d7462bc9624d11151947fc753ce0_NeikiAnalytics.exe	30
PID 2040 wrote to memory of 2264	2040	9905d7462bc9624d11151947fc753ce0_NeikiAnalytics.exe	30

C:\Users\Admin\AppData\Local\Temp\9905d7462bc9624d11151947fc753ce0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9905d7462bc9624d11151947fc753ce0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 708
  2⤵
  - Program crash
  PID:2264

memory/2040-0-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2040-1-0x0000000000400000-0x0000000000578000-memory.dmp

Filesize
1.5MB

Download