7c3689fe84d86b0088084d2dc1b53a7db5aff0a0a7574f51c5e67c2b308c14a6

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 05:01

Target

4dacac3a35e10e6f3be0d09ff0a00130_NeikiAnalytics.exe
Size

85KB
MD5

4dacac3a35e10e6f3be0d09ff0a00130
SHA1

6c144ef0eeec2121bcf5136c14d1a66b54b9c92f
SHA256

7c3689fe84d86b0088084d2dc1b53a7db5aff0a0a7574f51c5e67c2b308c14a6
SHA512

12cad7bd4b2ecb5f490439ba186e44aca20cc79cfdbc97434b4339c7bdab24c41262af953ff4a4e095e5937938a74c51d9b4c12b8151ac3d94ba244fd2aba057
SSDEEP

768:Ez8a1d5/M4reGe0bxU6nY1ERlGsTP0Jj8noHiThtALdXr:Kpreh+RLd0moHgEr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1604	1368	4dacac3a35e10e6f3be0d09ff0a00130_NeikiAnalytics.exe	28
PID 1368 wrote to memory of 1604	1368	4dacac3a35e10e6f3be0d09ff0a00130_NeikiAnalytics.exe	28
PID 1368 wrote to memory of 1604	1368	4dacac3a35e10e6f3be0d09ff0a00130_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\4dacac3a35e10e6f3be0d09ff0a00130_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4dacac3a35e10e6f3be0d09ff0a00130_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1368 -s 532
  2⤵
  PID:1604

memory/1368-0-0x000007FEF56B3000-0x000007FEF56B4000-memory.dmp

Filesize
4KB

Download
memory/1368-1-0x000000013F9C0000-0x000000013F9DA000-memory.dmp

Filesize
104KB

Download