6ef426520898ea1a8cc9e7579b287ba16e84220023e221635ee3d1f158365ba4

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 02:20

Target

518e16a1c442996df0711122e4e930a0_NeikiAnalytics.exe
Size

916KB
MD5

518e16a1c442996df0711122e4e930a0
SHA1

6ecfb7cfccc85153bf0be6e5f732c8a47f1d44da
SHA256

6ef426520898ea1a8cc9e7579b287ba16e84220023e221635ee3d1f158365ba4
SHA512

2226720f7bc2d10057e3fd8150a95b632000d38cf247ccac9b02e91ec54ed617e4ed6fc2e28c9b5dfe23478f1dd01a564ff6c8dd1e2e65496c3f85133ddd54a7
SSDEEP

12288:ndXgp6z4FKsN2E6LZ+Ym8SNckOd+BBaFRSYzhhoQZX2SZu3liq:nFg6z4FK5bLwYm8ScVdDPDO+X2se

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
1532	2172	WerFault.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 1532	2172	518e16a1c442996df0711122e4e930a0_NeikiAnalytics.exe	28
PID 2172 wrote to memory of 1532	2172	518e16a1c442996df0711122e4e930a0_NeikiAnalytics.exe	28
PID 2172 wrote to memory of 1532	2172	518e16a1c442996df0711122e4e930a0_NeikiAnalytics.exe	28
PID 2172 wrote to memory of 1532	2172	518e16a1c442996df0711122e4e930a0_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\518e16a1c442996df0711122e4e930a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\518e16a1c442996df0711122e4e930a0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 216
  2⤵
  - Program crash
  PID:1532