22459e81306ecc7947db9b8965b0de06831a1a7cb441d2cca4de6271d4bf4cb1

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02-07-2024 01:18

Target

22459e81306ecc7947db9b8965b0de06831a1a7cb441d2cca4de6271d4bf4cb1_NeikiAnalytics.exe
Size

731KB
MD5

42f1b1b9c7e5631af0b7ac6e33ef4030
SHA1

0dd6ee86330b1beee9b6711a845fc95f156175ea
SHA256

22459e81306ecc7947db9b8965b0de06831a1a7cb441d2cca4de6271d4bf4cb1
SHA512

5ea5c1b852fac51136af904e79d2401b710ef62e61c2d44c99cbbd498c09acbc301b4f5595c449dcc0c1a608dcbfb4e98a0abac23fcb8edcde978cb22185a89e
SSDEEP

6144:Fp19SmYRZbsuSBs3ojpe6aABlwZFsr5pOGJr3eRqk3tJc+xZRtiKzvzaOKIeM87y:Fp1EPZbsu2s3ojpe6aeSg3DeRqkUWJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

22459e81306ecc7947db9b8965b0de06831a1a7cb441d2cca4de6271d4bf4cb1_NeikiAnalytics.exe

description	pid	process	target process
PID 1540 wrote to memory of 1732	1540	22459e81306ecc7947db9b8965b0de06831a1a7cb441d2cca4de6271d4bf4cb1_NeikiAnalytics.exe	WerFault.exe
PID 1540 wrote to memory of 1732	1540	22459e81306ecc7947db9b8965b0de06831a1a7cb441d2cca4de6271d4bf4cb1_NeikiAnalytics.exe	WerFault.exe
PID 1540 wrote to memory of 1732	1540	22459e81306ecc7947db9b8965b0de06831a1a7cb441d2cca4de6271d4bf4cb1_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\22459e81306ecc7947db9b8965b0de06831a1a7cb441d2cca4de6271d4bf4cb1_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\22459e81306ecc7947db9b8965b0de06831a1a7cb441d2cca4de6271d4bf4cb1_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1540 -s 76
  2⤵
  PID:1732