0398f85df216a2e95e792853f215431fc1983928a7f596ea6cd135924c66e258

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 21:56

Target

0398f85df216a2e95e792853f215431fc1983928a7f596ea6cd135924c66e258_NeikiAnalytics.exe
Size

407KB
MD5

d0e9e6aac645b8c5af9f51430c75f9c0
SHA1

990407a4f8ddb6ca93d63f421d9a61b778669e95
SHA256

0398f85df216a2e95e792853f215431fc1983928a7f596ea6cd135924c66e258
SHA512

379aa05c9c0092bdb32b61cc0ae8489939c6bfcc9e95251442b00c855bb22bff6ee9a338e2eb936e0e1a16edec4e5b95e37925dadedf5dadac05f1759eec2205
SSDEEP

6144:nfI3vziGwqHxAw69zwPrDazpLr+mEY/6ft/5CScHbgrtUThx37iQ1mMY4wJ2s3:nA3riGwqHxFBWEY/ah5aIUbriQrjw

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1108 1936 WerFault.exe 0398f85df216a2e95e792853f215431fc1983928a7f596ea6cd135924c66e258_NeikiAnalytics.exe

pid	pid_target	process	target process
1108	1936	WerFault.exe	0398f85df216a2e95e792853f215431fc1983928a7f596ea6cd135924c66e258_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0398f85df216a2e95e792853f215431fc1983928a7f596ea6cd135924c66e258_NeikiAnalytics.exe

description	pid	process	target process
PID 1936 wrote to memory of 1108	1936	0398f85df216a2e95e792853f215431fc1983928a7f596ea6cd135924c66e258_NeikiAnalytics.exe	WerFault.exe
PID 1936 wrote to memory of 1108	1936	0398f85df216a2e95e792853f215431fc1983928a7f596ea6cd135924c66e258_NeikiAnalytics.exe	WerFault.exe
PID 1936 wrote to memory of 1108	1936	0398f85df216a2e95e792853f215431fc1983928a7f596ea6cd135924c66e258_NeikiAnalytics.exe	WerFault.exe
PID 1936 wrote to memory of 1108	1936	0398f85df216a2e95e792853f215431fc1983928a7f596ea6cd135924c66e258_NeikiAnalytics.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0398f85df216a2e95e792853f215431fc1983928a7f596ea6cd135924c66e258_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0398f85df216a2e95e792853f215431fc1983928a7f596ea6cd135924c66e258_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 96
2⤵
- Program crash
PID:1108

memory/1936-0-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download