d87963dfe40f497ee7d3d94e57cd5738ecc61f3cf843873133a6cbddb0a7b359

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 06:49

Target

f32311593d5a1f714570a7b91d9100e0_NeikiAnalytics.exe
Size

455KB
MD5

f32311593d5a1f714570a7b91d9100e0
SHA1

c343c18f3f208cf7719550fa4aaec1d77840e7da
SHA256

d87963dfe40f497ee7d3d94e57cd5738ecc61f3cf843873133a6cbddb0a7b359
SHA512

794b86df535b509b2bc442fb04475b8a113f7e568e8c9b5d9ffaa54ca7b9a71db84af163189ddd75175be84214571355bdd21becffc2b3c3b909a22ba10e6b5c
SSDEEP

12288:WVEue/UNolyeWYB0kGZFdLagJdF0S/xPaG9:WVEuegLagJdF0S5PaG9

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2100 1644 WerFault.exe f32311593d5a1f714570a7b91d9100e0_NeikiAnalytics.exe

pid	pid_target	process	target process
2100	1644	WerFault.exe	f32311593d5a1f714570a7b91d9100e0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f32311593d5a1f714570a7b91d9100e0_NeikiAnalytics.exe

description	pid	process	target process
PID 1644 wrote to memory of 2100	1644	f32311593d5a1f714570a7b91d9100e0_NeikiAnalytics.exe	WerFault.exe
PID 1644 wrote to memory of 2100	1644	f32311593d5a1f714570a7b91d9100e0_NeikiAnalytics.exe	WerFault.exe
PID 1644 wrote to memory of 2100	1644	f32311593d5a1f714570a7b91d9100e0_NeikiAnalytics.exe	WerFault.exe
PID 1644 wrote to memory of 2100	1644	f32311593d5a1f714570a7b91d9100e0_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\f32311593d5a1f714570a7b91d9100e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\f32311593d5a1f714570a7b91d9100e0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 36
2⤵
- Program crash
PID:2100

memory/1644-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download