38aa2ccf4e4274be9461551ec03498baf0a52b586bb236e3e77f3de19aa46a44

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 20:15

Target

f40776565efca5a38894f893f1417ad0_NeikiAnalytics.exe
Size

235KB
MD5

f40776565efca5a38894f893f1417ad0
SHA1

6d571ff25d8c7c34dcb5960be35b41d1c3fa555e
SHA256

38aa2ccf4e4274be9461551ec03498baf0a52b586bb236e3e77f3de19aa46a44
SHA512

cbce08acac4165722427693594d173159ff789d4eedf03adf87696de92e6aa299e6fb376f469030a47ccf1a3cbe13355fcd0bd1f45a4aec7ab944fee9a4dedf1
SSDEEP

3072:Z0W5BDiuMi8R/rfA6nFUepMO3tQeXF7ApJhCSMQHlUiVf8k75zOQzsFfa8ZFvH:quk/fqc7AJN7ki1KFvH

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
4700	4416	WerFault.exe	f40776565efca5a38894f893f1417ad0_NeikiAnalytics.exe
116	4416	WerFault.exe	f40776565efca5a38894f893f1417ad0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

f40776565efca5a38894f893f1417ad0_NeikiAnalytics.exe

description	pid	process	target process
PID 4416 wrote to memory of 4700	4416	f40776565efca5a38894f893f1417ad0_NeikiAnalytics.exe	WerFault.exe
PID 4416 wrote to memory of 4700	4416	f40776565efca5a38894f893f1417ad0_NeikiAnalytics.exe	WerFault.exe
PID 4416 wrote to memory of 4700	4416	f40776565efca5a38894f893f1417ad0_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\f40776565efca5a38894f893f1417ad0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\f40776565efca5a38894f893f1417ad0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 240
  2⤵
  - Program crash
  PID:4700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 240
  2⤵
  - Program crash
  PID:116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4416 -ip 4416
1⤵
PID:1272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3816 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:3988