c0db610df01b7027755eb5a2d9720fe585ef7e6890cdcbed82de3dbf7c0f1980

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 22:55

Target

5a08b0624959c8cc07277148a3c25870_NEIKI.exe
Size

411KB
MD5

5a08b0624959c8cc07277148a3c25870
SHA1

9148a79f5f1f5f867658b6da80ed062c5362eebf
SHA256

c0db610df01b7027755eb5a2d9720fe585ef7e6890cdcbed82de3dbf7c0f1980
SHA512

4837a96e80117a357d3eee0d49ec9519b5316852b01541d49088b570efc1b49997810eef1d79037efbaf54803283bb9ca4d7aacc9ce4b1143d4a0b1d1a21a20f
SSDEEP

384:XJ6wayA+1mwnA353BXR+oGfPmfm4MlcTGXdhjwroyY2rebV5O6KhdWb/83BXR+o8:ZpQNwC3BESe4Vqth+0V5vKUE3BEJwRrs

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1264	2228	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1264	2228	5a08b0624959c8cc07277148a3c25870_NEIKI.exe	28
PID 2228 wrote to memory of 1264	2228	5a08b0624959c8cc07277148a3c25870_NEIKI.exe	28
PID 2228 wrote to memory of 1264	2228	5a08b0624959c8cc07277148a3c25870_NEIKI.exe	28
PID 2228 wrote to memory of 1264	2228	5a08b0624959c8cc07277148a3c25870_NEIKI.exe	28

C:\Users\Admin\AppData\Local\Temp\5a08b0624959c8cc07277148a3c25870_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\5a08b0624959c8cc07277148a3c25870_NEIKI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 36
  2⤵
  - Program crash
  PID:1264