ab0868e438366d6b6b6cc8b6ca69ffb47d26411ea3b61a18b193902b05ee0d7e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 21:48

Target

67da6c98f82b7960cc4f1748cf4bc970_NEIKI.exe
Size

119KB
MD5

67da6c98f82b7960cc4f1748cf4bc970
SHA1

d5aa2c5cbae2566e21dd66353855469a437cf19f
SHA256

ab0868e438366d6b6b6cc8b6ca69ffb47d26411ea3b61a18b193902b05ee0d7e
SHA512

0f947c819f584271a422ddd6c3a11f66d8bdb9f5b9e4d8c2d99b792be92dc6ca55dd008eb34be3478fed5ff4b5b8460189437dae28e28a410093173e9d91cfd4
SSDEEP

3072:dzM8TyqVt14NWyNIWqNUVIFbDV5zcaXf4zJ6KYax/ByLUiK:lnTyWNyqpeO5ncav4zlbyq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3064	2936	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 3064	2936	67da6c98f82b7960cc4f1748cf4bc970_NEIKI.exe	28
PID 2936 wrote to memory of 3064	2936	67da6c98f82b7960cc4f1748cf4bc970_NEIKI.exe	28
PID 2936 wrote to memory of 3064	2936	67da6c98f82b7960cc4f1748cf4bc970_NEIKI.exe	28
PID 2936 wrote to memory of 3064	2936	67da6c98f82b7960cc4f1748cf4bc970_NEIKI.exe	28

C:\Users\Admin\AppData\Local\Temp\67da6c98f82b7960cc4f1748cf4bc970_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\67da6c98f82b7960cc4f1748cf4bc970_NEIKI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 36
  2⤵
  - Program crash
  PID:3064

memory/2936-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2936-1-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download