cc63700e001af6d756c97e7bae19da2e700eb200bfb5ce1bde7ce74fdbffd2fb

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 13:48

Target

55969a8305b9f2bf1d8e858ee0501d50_NeikiAnalytics.exe
Size

558KB
MD5

55969a8305b9f2bf1d8e858ee0501d50
SHA1

029fdd4d02e8787a4b013cb5b29b991133b037ae
SHA256

cc63700e001af6d756c97e7bae19da2e700eb200bfb5ce1bde7ce74fdbffd2fb
SHA512

7a774d951c8f29133c92e06620fe03db1579e99c424bd5b983c3349586344e6f2e388eedc55f782dd0a7bfb8a932714a1707b6971eb6131822ca56c224ca46cd
SSDEEP

12288:b39fegoDhrUC40+qmpt8a0fSOHehsuTXltfhywDrqX9rBz3mLEPFzXWxVIc6MN9:btfeTFrUC4Xqmpt8a0fSOHeKuTVttD2b

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2044 2180 WerFault.exe 55969a8305b9f2bf1d8e858ee0501d50_NeikiAnalytics.exe

pid	pid_target	process	target process
2044	2180	WerFault.exe	55969a8305b9f2bf1d8e858ee0501d50_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

55969a8305b9f2bf1d8e858ee0501d50_NeikiAnalytics.exe

description	pid	process	target process
PID 2180 wrote to memory of 2044	2180	55969a8305b9f2bf1d8e858ee0501d50_NeikiAnalytics.exe	WerFault.exe
PID 2180 wrote to memory of 2044	2180	55969a8305b9f2bf1d8e858ee0501d50_NeikiAnalytics.exe	WerFault.exe
PID 2180 wrote to memory of 2044	2180	55969a8305b9f2bf1d8e858ee0501d50_NeikiAnalytics.exe	WerFault.exe
PID 2180 wrote to memory of 2044	2180	55969a8305b9f2bf1d8e858ee0501d50_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\55969a8305b9f2bf1d8e858ee0501d50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\55969a8305b9f2bf1d8e858ee0501d50_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 120
2⤵
- Program crash
PID:2044