e72173ac780322b986fe9ae3e7107a4b0d98df866100048bfb9bbfa84dcb0f51

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 03:01

Target

57fc42da5848ab602c949d66ffacc5f0_NeikiAnalytics.exe
Size

590KB
MD5

57fc42da5848ab602c949d66ffacc5f0
SHA1

2f6573c9bacb3b9315e7de3d056944caf33977d2
SHA256

e72173ac780322b986fe9ae3e7107a4b0d98df866100048bfb9bbfa84dcb0f51
SHA512

52fe493473e96429dbf4184a5099f2cdb361d70e4b9e561da07ccf861ebba5bb6ede013f15f55c68a753c02c4731d52652b1be4ad538669fb63e9079707d8429
SSDEEP

6144:wqDAwl0xPTMiR9JSSxPUKododHVwpnOS9:w+67XR9JSSxvododHVwpOS9

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1912 1920 WerFault.exe 57fc42da5848ab602c949d66ffacc5f0_NeikiAnalytics.exe

pid	pid_target	process	target process
1912	1920	WerFault.exe	57fc42da5848ab602c949d66ffacc5f0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

57fc42da5848ab602c949d66ffacc5f0_NeikiAnalytics.exe

description	pid	process	target process
PID 1920 wrote to memory of 1912	1920	57fc42da5848ab602c949d66ffacc5f0_NeikiAnalytics.exe	WerFault.exe
PID 1920 wrote to memory of 1912	1920	57fc42da5848ab602c949d66ffacc5f0_NeikiAnalytics.exe	WerFault.exe
PID 1920 wrote to memory of 1912	1920	57fc42da5848ab602c949d66ffacc5f0_NeikiAnalytics.exe	WerFault.exe
PID 1920 wrote to memory of 1912	1920	57fc42da5848ab602c949d66ffacc5f0_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\57fc42da5848ab602c949d66ffacc5f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\57fc42da5848ab602c949d66ffacc5f0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 36
2⤵
- Program crash
PID:1912