e2c7258e9241016764900551f88daa484540889f2df806246fc21b01261268d0

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 04:21

Target

64943e672a9b9b173f60278c5da783c0_NeikiAnalytics.exe
Size

669KB
MD5

64943e672a9b9b173f60278c5da783c0
SHA1

cd16d3c6aaa7439e8506b2b70c3891c90a5b5f62
SHA256

e2c7258e9241016764900551f88daa484540889f2df806246fc21b01261268d0
SHA512

495a7cb92c412b85d1f976f9e799bb5aed9075f7caaaf81744ab57a715f2e4c70bf5318bf19bc1720647c731240236730a1f2df6dee710b553b327b4a32e4812
SSDEEP

6144:xwrGnfIRzRSPpwMHjH4ZGL3O0b83ii96AMaJB8udk4+xZRtiKzvzaOLVYY:xAGwtRSPuMHjH0GL3OB3x6Faa6Y

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

64943e672a9b9b173f60278c5da783c0_NeikiAnalytics.exe

description	pid	process	target process
PID 2980 wrote to memory of 2292	2980	64943e672a9b9b173f60278c5da783c0_NeikiAnalytics.exe	WerFault.exe
PID 2980 wrote to memory of 2292	2980	64943e672a9b9b173f60278c5da783c0_NeikiAnalytics.exe	WerFault.exe
PID 2980 wrote to memory of 2292	2980	64943e672a9b9b173f60278c5da783c0_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\64943e672a9b9b173f60278c5da783c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\64943e672a9b9b173f60278c5da783c0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2980

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2980 -s 76
2⤵
PID:2292