2a7f28bd4a82bdab5db8c2b1dfac1e55c54f04f4db8e6a66bd80c65cdce4976c

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 09:18

Target

2a7f28bd4a82bdab5db8c2b1dfac1e55c54f04f4db8e6a66bd80c65cdce4976c_NeikiAnalytics.exe
Size

426KB
MD5

0b8d38e451d33b36fab964ac76e19da0
SHA1

e539cf8cac4849c9a357c8820e3b609e1279586d
SHA256

2a7f28bd4a82bdab5db8c2b1dfac1e55c54f04f4db8e6a66bd80c65cdce4976c
SHA512

98c085d417d6371bc66f828d507b84d8116a222c585427f1dd339d5875c911409be52c8b46c2bd61de3789b5eb540716e921bb062c85258a4627e28583bf3f5f
SSDEEP

6144:8Z5f30291xuMHlpw9wrvwewMdBtbIbd5xv6P/6CuCNJ0hOYZ:8nk291kMHlpw6r4eL3IbxvoyClwzZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2a7f28bd4a82bdab5db8c2b1dfac1e55c54f04f4db8e6a66bd80c65cdce4976c_NeikiAnalytics.exe

description	pid	process	target process
PID 2812 wrote to memory of 2036	2812	2a7f28bd4a82bdab5db8c2b1dfac1e55c54f04f4db8e6a66bd80c65cdce4976c_NeikiAnalytics.exe	WerFault.exe
PID 2812 wrote to memory of 2036	2812	2a7f28bd4a82bdab5db8c2b1dfac1e55c54f04f4db8e6a66bd80c65cdce4976c_NeikiAnalytics.exe	WerFault.exe
PID 2812 wrote to memory of 2036	2812	2a7f28bd4a82bdab5db8c2b1dfac1e55c54f04f4db8e6a66bd80c65cdce4976c_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2a7f28bd4a82bdab5db8c2b1dfac1e55c54f04f4db8e6a66bd80c65cdce4976c_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2a7f28bd4a82bdab5db8c2b1dfac1e55c54f04f4db8e6a66bd80c65cdce4976c_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2812

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2812 -s 76
2⤵
PID:2036