7dc04e671470d675e9a2a6e377960f2876f34df1748b4beb74509ee1b8908bb8

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 02:09

Target

4fe1f17e7a1f3fb5b160886f1d1a2e90_NeikiAnalytics.exe
Size

380KB
MD5

4fe1f17e7a1f3fb5b160886f1d1a2e90
SHA1

4c1f63bd5c1892d43ea03d1b475341912dfa2137
SHA256

7dc04e671470d675e9a2a6e377960f2876f34df1748b4beb74509ee1b8908bb8
SHA512

4a3a9af0905a1546a30d34cbf1f0382714a559df355cb358b59250e0812dbcfeb0534c5f6a1e077d2380b97ad19adcdee55914752628126da747a52e5f28f718
SSDEEP

3072:KMK/yLrQbWaR5Qax8cJYtyMPM58uYOZGJdOTBf9Uf1n7dmZf+:KnyLEbWaR5CcXMwnGJdOTB1Uf1n7a

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1716 1196 WerFault.exe 4fe1f17e7a1f3fb5b160886f1d1a2e90_NeikiAnalytics.exe

pid	pid_target	process	target process
1716	1196	WerFault.exe	4fe1f17e7a1f3fb5b160886f1d1a2e90_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4fe1f17e7a1f3fb5b160886f1d1a2e90_NeikiAnalytics.exe

description	pid	process	target process
PID 1196 wrote to memory of 1716	1196	4fe1f17e7a1f3fb5b160886f1d1a2e90_NeikiAnalytics.exe	WerFault.exe
PID 1196 wrote to memory of 1716	1196	4fe1f17e7a1f3fb5b160886f1d1a2e90_NeikiAnalytics.exe	WerFault.exe
PID 1196 wrote to memory of 1716	1196	4fe1f17e7a1f3fb5b160886f1d1a2e90_NeikiAnalytics.exe	WerFault.exe
PID 1196 wrote to memory of 1716	1196	4fe1f17e7a1f3fb5b160886f1d1a2e90_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4fe1f17e7a1f3fb5b160886f1d1a2e90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4fe1f17e7a1f3fb5b160886f1d1a2e90_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 36
2⤵
- Program crash
PID:1716