1e6f0858dbaf70117b29d03cbd29f61ca6d5105b39f2d816d48f092f32a2ed5b

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 22:18

Target

1e6f0858dbaf70117b29d03cbd29f61ca6d5105b39f2d816d48f092f32a2ed5b_NeikiAnalytics.exe
Size

732KB
MD5

b4e735cc68600aad988aed02f77c03b0
SHA1

eea087cd4265b65461ce5c80856b124af3861213
SHA256

1e6f0858dbaf70117b29d03cbd29f61ca6d5105b39f2d816d48f092f32a2ed5b
SHA512

f00358050f2c2be8a361cbf15139cc28cdb8b2ba6bc10e3d85a479d005e31c13fe2c961ff989868d407af45cb45f190f48ff6e5b7b6e74cc6328584cb9ac6925
SSDEEP

12288:JnCSRm0gP/xVoBUQUX3lxmcs0jaKE+sqdTSSwcGXGg6mE3a4phWOlgFZBu13MwUo:pCemnPZVo+Xit6deSwcGXGhmE3a4OFZA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1292	2852	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 1292	2852	1e6f0858dbaf70117b29d03cbd29f61ca6d5105b39f2d816d48f092f32a2ed5b_NeikiAnalytics.exe	28
PID 2852 wrote to memory of 1292	2852	1e6f0858dbaf70117b29d03cbd29f61ca6d5105b39f2d816d48f092f32a2ed5b_NeikiAnalytics.exe	28
PID 2852 wrote to memory of 1292	2852	1e6f0858dbaf70117b29d03cbd29f61ca6d5105b39f2d816d48f092f32a2ed5b_NeikiAnalytics.exe	28
PID 2852 wrote to memory of 1292	2852	1e6f0858dbaf70117b29d03cbd29f61ca6d5105b39f2d816d48f092f32a2ed5b_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\1e6f0858dbaf70117b29d03cbd29f61ca6d5105b39f2d816d48f092f32a2ed5b_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1e6f0858dbaf70117b29d03cbd29f61ca6d5105b39f2d816d48f092f32a2ed5b_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 128
  2⤵
  - Program crash
  PID:1292