5ddea669d9877020ad6b9612a53ded95409a0d92425f8caf0de96008a797dc14

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 20:34

Target

1c3801b7174d1edab3f907f7e57e4750_NeikiAnalytics.exe
Size

477KB
MD5

1c3801b7174d1edab3f907f7e57e4750
SHA1

384c9a800dcc14ab8b4b9aea1d53f1b0281ebe90
SHA256

5ddea669d9877020ad6b9612a53ded95409a0d92425f8caf0de96008a797dc14
SHA512

35573c4f682079042e9b58e7dd325a25c39b50fdb851931c7186381ea19a22311adb54e1d0e25e492a3044afc42271966cb9a9bf521db66553ce7c1ea577cea2
SSDEEP

12288:CX8/Vx65HCnDAByqulR1fZJQPs/Z8YRq:p/Vc5HCnDABMfZJQyZj

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2448 2444 WerFault.exe 1c3801b7174d1edab3f907f7e57e4750_NeikiAnalytics.exe

pid	pid_target	process	target process
2448	2444	WerFault.exe	1c3801b7174d1edab3f907f7e57e4750_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1c3801b7174d1edab3f907f7e57e4750_NeikiAnalytics.exe

description	pid	process	target process
PID 2444 wrote to memory of 2448	2444	1c3801b7174d1edab3f907f7e57e4750_NeikiAnalytics.exe	WerFault.exe
PID 2444 wrote to memory of 2448	2444	1c3801b7174d1edab3f907f7e57e4750_NeikiAnalytics.exe	WerFault.exe
PID 2444 wrote to memory of 2448	2444	1c3801b7174d1edab3f907f7e57e4750_NeikiAnalytics.exe	WerFault.exe
PID 2444 wrote to memory of 2448	2444	1c3801b7174d1edab3f907f7e57e4750_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1c3801b7174d1edab3f907f7e57e4750_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1c3801b7174d1edab3f907f7e57e4750_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 172
2⤵
- Program crash
PID:2448