9958b0c28e4cacb4ba50c2cf176839c50d920dab06b2b8b958dd47fd78940aa8

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 02:40

Target

1ab6cdd8f72f52dc81b82c3abbafb2c0_NeikiAnalytics.exe
Size

33KB
MD5

1ab6cdd8f72f52dc81b82c3abbafb2c0
SHA1

58ff0779f267d00c1928eb67a0b4fa1f74e9bcbe
SHA256

9958b0c28e4cacb4ba50c2cf176839c50d920dab06b2b8b958dd47fd78940aa8
SHA512

590ac14e8fa8ec98025dc5339b3096ab393f999835dd1a161e97455a65cd0a616108eb0877202f17d1a9cebf66265037debceed9881a9f532c6a1ef54a8d6485
SSDEEP

768:rOMtvRrUOKMfous8C+ZeUDtY6ENNglEajvuZTpSO0biEomV:SMtvR42flXhDK60NkQpSO0bRomV

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1260 2756 WerFault.exe 1ab6cdd8f72f52dc81b82c3abbafb2c0_NeikiAnalytics.exe

pid	pid_target	process	target process
1260	2756	WerFault.exe	1ab6cdd8f72f52dc81b82c3abbafb2c0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1ab6cdd8f72f52dc81b82c3abbafb2c0_NeikiAnalytics.exe

description	pid	process	target process
PID 2756 wrote to memory of 1260	2756	1ab6cdd8f72f52dc81b82c3abbafb2c0_NeikiAnalytics.exe	WerFault.exe
PID 2756 wrote to memory of 1260	2756	1ab6cdd8f72f52dc81b82c3abbafb2c0_NeikiAnalytics.exe	WerFault.exe
PID 2756 wrote to memory of 1260	2756	1ab6cdd8f72f52dc81b82c3abbafb2c0_NeikiAnalytics.exe	WerFault.exe
PID 2756 wrote to memory of 1260	2756	1ab6cdd8f72f52dc81b82c3abbafb2c0_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1ab6cdd8f72f52dc81b82c3abbafb2c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1ab6cdd8f72f52dc81b82c3abbafb2c0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 272
2⤵
- Program crash
PID:1260