2fb796598982f444de68e9d32d1ee6fb7f68874ed83b2e0ff8a3f283127aa8e9

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
26/06/2024, 00:55

Target

2fb796598982f444de68e9d32d1ee6fb7f68874ed83b2e0ff8a3f283127aa8e9_NeikiAnalytics.exe
Size

2.5MB
MD5

aef31aa12188ce9abcef5aa0f6886040
SHA1

933edabe4b65e2d7335e4ddfeb433bbcf9ea637e
SHA256

2fb796598982f444de68e9d32d1ee6fb7f68874ed83b2e0ff8a3f283127aa8e9
SHA512

0d69b5c9622a34f9c553d4a7d40351e6a2967ce14e43787d28d34677df2e278f43d9913eb3b8c3299f0cbf657cda9fc30895fa4469cb968f5156c0711cda039d
SSDEEP

49152:ARltcHNJ+nZg8wCufB+agTS7Uq4jZbIJOYjfJNTzujnvtejfu+QQWpy:n4qwjYjzuDtebu+CQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 1540	2852	2fb796598982f444de68e9d32d1ee6fb7f68874ed83b2e0ff8a3f283127aa8e9_NeikiAnalytics.exe	28
PID 2852 wrote to memory of 1540	2852	2fb796598982f444de68e9d32d1ee6fb7f68874ed83b2e0ff8a3f283127aa8e9_NeikiAnalytics.exe	28
PID 2852 wrote to memory of 1540	2852	2fb796598982f444de68e9d32d1ee6fb7f68874ed83b2e0ff8a3f283127aa8e9_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\2fb796598982f444de68e9d32d1ee6fb7f68874ed83b2e0ff8a3f283127aa8e9_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2fb796598982f444de68e9d32d1ee6fb7f68874ed83b2e0ff8a3f283127aa8e9_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2852 -s 212
  2⤵
  PID:1540