5e4ea36762c6a655aecbf8bd7a7d6a1eed50c7dd8366d85648cebfab64f7c0bc | Triage

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 19:07

Sharing

Report Analysis Logs

General

Target

0df826c9faf38e7c5bf06d51fe37a3d0_NeikiAnalytics.exe
Size

229KB
MD5

0df826c9faf38e7c5bf06d51fe37a3d0
SHA1

c32d0cfdb9c77cad2cf609efe466539b24e7f580
SHA256

5e4ea36762c6a655aecbf8bd7a7d6a1eed50c7dd8366d85648cebfab64f7c0bc
SHA512

e0a34422a494f8878dc2a568c6fa6d3c066e1cb1f06e150ff85543ec5e0c6bad20f9e078d3dff7686e0c2f7dc67a37fe47c582d3603e94e704a621d48225c5bf
SSDEEP

6144:7iVQQG75dpcElElt/DgK1yuFShGJm2BA:rBKE6LguFSYJA

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2244 2248 WerFault.exe 0df826c9faf38e7c5bf06d51fe37a3d0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0df826c9faf38e7c5bf06d51fe37a3d0_NeikiAnalytics.exe

description	pid	process	target process
PID 2248 wrote to memory of 2244	2248	0df826c9faf38e7c5bf06d51fe37a3d0_NeikiAnalytics.exe	WerFault.exe
PID 2248 wrote to memory of 2244	2248	0df826c9faf38e7c5bf06d51fe37a3d0_NeikiAnalytics.exe	WerFault.exe
PID 2248 wrote to memory of 2244	2248	0df826c9faf38e7c5bf06d51fe37a3d0_NeikiAnalytics.exe	WerFault.exe
PID 2248 wrote to memory of 2244	2248	0df826c9faf38e7c5bf06d51fe37a3d0_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0df826c9faf38e7c5bf06d51fe37a3d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0df826c9faf38e7c5bf06d51fe37a3d0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 120
2⤵
- Program crash
PID:2244

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...