5665772df22184c198da66d21df1fa944bd3cc45aad44a2c966a6a5dc4975d0e

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 10:26

Target

5665772df22184c198da66d21df1fa944bd3cc45aad44a2c966a6a5dc4975d0e_NeikiAnalytics.exe
Size

551KB
MD5

fad68077112c2b68db96ebba8db26240
SHA1

35244d221f1f1986e76711a5c06791d9da340efb
SHA256

5665772df22184c198da66d21df1fa944bd3cc45aad44a2c966a6a5dc4975d0e
SHA512

573e7ec48a3ff7a3347f32de6542973c83ed687166b736f624b2ab78f8074f8526a9366741e28bee436eb329ef5ac82a7c72b77ffb00a39109d3ff90948f88c6
SSDEEP

12288:citzpAZFQN5jxJqqaSjd5JvoLHlnKD5ziha6kyt4DVecuzEMoNACxJd:vgqagQlVhsecuzEMoNP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 3032	2928	5665772df22184c198da66d21df1fa944bd3cc45aad44a2c966a6a5dc4975d0e_NeikiAnalytics.exe	28
PID 2928 wrote to memory of 3032	2928	5665772df22184c198da66d21df1fa944bd3cc45aad44a2c966a6a5dc4975d0e_NeikiAnalytics.exe	28
PID 2928 wrote to memory of 3032	2928	5665772df22184c198da66d21df1fa944bd3cc45aad44a2c966a6a5dc4975d0e_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\5665772df22184c198da66d21df1fa944bd3cc45aad44a2c966a6a5dc4975d0e_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5665772df22184c198da66d21df1fa944bd3cc45aad44a2c966a6a5dc4975d0e_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2928 -s 532
  2⤵
  PID:3032

memory/2928-0-0x000007FEF5BF3000-0x000007FEF5BF4000-memory.dmp

Filesize
4KB

Download
memory/2928-1-0x0000000000B30000-0x0000000000BBA000-memory.dmp

Filesize
552KB

Download
memory/2928-2-0x000007FEF5BF3000-0x000007FEF5BF4000-memory.dmp

Filesize
4KB

Download