3cf6c267f8d9daa495a2fef7063a89c591352dcad95b81704cfb780546a446d8

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 05:32

Target

a5d47c6264bccfe1a33ad3b606a18650_NeikiAnalytics.exe
Size

669KB
MD5

a5d47c6264bccfe1a33ad3b606a18650
SHA1

0866f010530fd7f2441229d85b6f3e8b96de8ab2
SHA256

3cf6c267f8d9daa495a2fef7063a89c591352dcad95b81704cfb780546a446d8
SHA512

4dfedf61a19475117b0789ff6a4197c705bc8fba6389027cfbeab39fafe42f88606790f9db8bda8612fea9af59ffefb4d7c42b8e9ccb8fc2bb7e939c6a9b7214
SSDEEP

6144:xwrGnfIRzRSPpwMHjH4ZGL3O0b83ii96AMaJB8udk4+xZRtiKzvzaOLVYP:xAGwtRSPuMHjH0GL3OB3x6Faa6P

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a5d47c6264bccfe1a33ad3b606a18650_NeikiAnalytics.exe

description	pid	process	target process
PID 2780 wrote to memory of 1520	2780	a5d47c6264bccfe1a33ad3b606a18650_NeikiAnalytics.exe	WerFault.exe
PID 2780 wrote to memory of 1520	2780	a5d47c6264bccfe1a33ad3b606a18650_NeikiAnalytics.exe	WerFault.exe
PID 2780 wrote to memory of 1520	2780	a5d47c6264bccfe1a33ad3b606a18650_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a5d47c6264bccfe1a33ad3b606a18650_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a5d47c6264bccfe1a33ad3b606a18650_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2780 -s 76
  2⤵
  PID:1520