d411514d7f72b8526d3c79c18aff5fd586b249aaa1b56a396c11a99e6a9ceb91

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 10:59

Target

9d447b4c1571dd61c9c56b09d240ee80_NeikiAnalytics.exe
Size

426KB
MD5

9d447b4c1571dd61c9c56b09d240ee80
SHA1

1183a725be092c6f7af518075e5b98ba19b25774
SHA256

d411514d7f72b8526d3c79c18aff5fd586b249aaa1b56a396c11a99e6a9ceb91
SHA512

28d4fb197cd45b8a81105bee26ff3183b36a3953f141379d25234b70ca3526fb6aaf519680f35bd0625076273d6c0ba7d9af6128154fd0c6a2db2e4c606e80d2
SSDEEP

6144:8Z5f30291xuMHlpw9wrvwewMdBtbIbd5xv6P/6CuCNJ0hOYC:8nk291kMHlpw6r4eL3IbxvoyClwzC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

9d447b4c1571dd61c9c56b09d240ee80_NeikiAnalytics.exe

description	pid	process	target process
PID 1900 wrote to memory of 1012	1900	9d447b4c1571dd61c9c56b09d240ee80_NeikiAnalytics.exe	WerFault.exe
PID 1900 wrote to memory of 1012	1900	9d447b4c1571dd61c9c56b09d240ee80_NeikiAnalytics.exe	WerFault.exe
PID 1900 wrote to memory of 1012	1900	9d447b4c1571dd61c9c56b09d240ee80_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9d447b4c1571dd61c9c56b09d240ee80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9d447b4c1571dd61c9c56b09d240ee80_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1900 -s 76
2⤵
PID:1012