130611cab28ce195abd4e7e36bf64bbc55c5cdb56fae47216514566905f18736

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 05:42

Target

740e34228d7871bcb7359f72464d8320_NeikiAnalytics.exe
Size

80KB
MD5

740e34228d7871bcb7359f72464d8320
SHA1

84918302c5b4c3716ab4095525e3f3bcb92d7190
SHA256

130611cab28ce195abd4e7e36bf64bbc55c5cdb56fae47216514566905f18736
SHA512

a865b52dc0d70fe78aaef953b1a60e796792efca3c449efb00f2f43e3fd1c9d58dba7cf1a15cb7efe878f213fc7539add43f3f52ed2d65cce069860ba6397ee6
SSDEEP

1536:DSwNE6vqTg1pvNeFrCiPZuDVKR/70933o1TvxEo3kZcH:DNJrlsPZSVScoEogcH

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2228 2864 WerFault.exe 740e34228d7871bcb7359f72464d8320_NeikiAnalytics.exe

pid	pid_target	process	target process
2228	2864	WerFault.exe	740e34228d7871bcb7359f72464d8320_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

740e34228d7871bcb7359f72464d8320_NeikiAnalytics.exe

description	pid	process	target process
PID 2864 wrote to memory of 2228	2864	740e34228d7871bcb7359f72464d8320_NeikiAnalytics.exe	WerFault.exe
PID 2864 wrote to memory of 2228	2864	740e34228d7871bcb7359f72464d8320_NeikiAnalytics.exe	WerFault.exe
PID 2864 wrote to memory of 2228	2864	740e34228d7871bcb7359f72464d8320_NeikiAnalytics.exe	WerFault.exe
PID 2864 wrote to memory of 2228	2864	740e34228d7871bcb7359f72464d8320_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\740e34228d7871bcb7359f72464d8320_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\740e34228d7871bcb7359f72464d8320_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 172
2⤵
- Program crash
PID:2228