221a2cbab69a4550a773d07615d6c6c264035fd0d22a2b706fd771410933d98f

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 14:44

Target

dfca2ca74b26746929f9dea15c0249e0_NEIKI.exe
Size

462KB
MD5

dfca2ca74b26746929f9dea15c0249e0
SHA1

6c69c9a603d277af11a4793727d737c8d7f8de1c
SHA256

221a2cbab69a4550a773d07615d6c6c264035fd0d22a2b706fd771410933d98f
SHA512

973115e98606442301472d0b991f7b8b9404e651b3e76cdb3aa211510c23682ff652a81596c52ec761ab7c7155f47d717e0b211a8e27da05fcc98f7892c92e84
SSDEEP

12288:Edy0t/5TvlqVMVfALllCMcr91sAEF8UIa7p21+RdJy:Y/5jly7CD91mFeQYQRP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3048	844	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 3048	844	dfca2ca74b26746929f9dea15c0249e0_NEIKI.exe	29
PID 844 wrote to memory of 3048	844	dfca2ca74b26746929f9dea15c0249e0_NEIKI.exe	29
PID 844 wrote to memory of 3048	844	dfca2ca74b26746929f9dea15c0249e0_NEIKI.exe	29
PID 844 wrote to memory of 3048	844	dfca2ca74b26746929f9dea15c0249e0_NEIKI.exe	29

C:\Users\Admin\AppData\Local\Temp\dfca2ca74b26746929f9dea15c0249e0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\dfca2ca74b26746929f9dea15c0249e0_NEIKI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 36
  2⤵
  - Program crash
  PID:3048

memory/844-0-0x00000000001C4000-0x00000000001C5000-memory.dmp

Filesize
4KB

Download