cc63700e001af6d756c97e7bae19da2e700eb200bfb5ce1bde7ce74fdbffd2fb

Analysis

max time kernel
140s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 13:48

Target

55969a8305b9f2bf1d8e858ee0501d50_NeikiAnalytics.exe
Size

558KB
MD5

55969a8305b9f2bf1d8e858ee0501d50
SHA1

029fdd4d02e8787a4b013cb5b29b991133b037ae
SHA256

cc63700e001af6d756c97e7bae19da2e700eb200bfb5ce1bde7ce74fdbffd2fb
SHA512

7a774d951c8f29133c92e06620fe03db1579e99c424bd5b983c3349586344e6f2e388eedc55f782dd0a7bfb8a932714a1707b6971eb6131822ca56c224ca46cd
SSDEEP

12288:b39fegoDhrUC40+qmpt8a0fSOHehsuTXltfhywDrqX9rBz3mLEPFzXWxVIc6MN9:btfeTFrUC4Xqmpt8a0fSOHeKuTVttD2b

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
2452	4496	WerFault.exe	55969a8305b9f2bf1d8e858ee0501d50_NeikiAnalytics.exe
4176	4496	WerFault.exe	55969a8305b9f2bf1d8e858ee0501d50_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

55969a8305b9f2bf1d8e858ee0501d50_NeikiAnalytics.exe

description	pid	process	target process
PID 4496 wrote to memory of 2452	4496	55969a8305b9f2bf1d8e858ee0501d50_NeikiAnalytics.exe	WerFault.exe
PID 4496 wrote to memory of 2452	4496	55969a8305b9f2bf1d8e858ee0501d50_NeikiAnalytics.exe	WerFault.exe
PID 4496 wrote to memory of 2452	4496	55969a8305b9f2bf1d8e858ee0501d50_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\55969a8305b9f2bf1d8e858ee0501d50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\55969a8305b9f2bf1d8e858ee0501d50_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 376
2⤵
- Program crash
PID:2452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 376
2⤵
- Program crash
PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4496 -ip 4496
1⤵
PID:1132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:556