5996e339d6079edbac3d1a090b88a46580ea20a9f88a2e048c58adae60c5db58

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 20:29

Target

410d8952f780ac45e3a4ea75453821d0_NEIKI.exe
Size

204KB
MD5

410d8952f780ac45e3a4ea75453821d0
SHA1

5a041deb48f183e35ba1b78653b95c28f6316038
SHA256

5996e339d6079edbac3d1a090b88a46580ea20a9f88a2e048c58adae60c5db58
SHA512

59abd4ad7f48f1c460e751a059eafa5748214d6d0cf868bfc6628e1170ed1ab7f5c45be20c4a28875f93e64d5a091cddef2b6e2326d6293b6d2a740c9311ae22
SSDEEP

768:76cPsAifwZJ0cZGUk6vJOBdhqm2PeaiBWJQekcrJU02p/1H53Xdnh:GccYH/Gnc+hmlJQekEC02LP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1516	2892	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 1516	2892	410d8952f780ac45e3a4ea75453821d0_NEIKI.exe	28
PID 2892 wrote to memory of 1516	2892	410d8952f780ac45e3a4ea75453821d0_NEIKI.exe	28
PID 2892 wrote to memory of 1516	2892	410d8952f780ac45e3a4ea75453821d0_NEIKI.exe	28
PID 2892 wrote to memory of 1516	2892	410d8952f780ac45e3a4ea75453821d0_NEIKI.exe	28

C:\Users\Admin\AppData\Local\Temp\410d8952f780ac45e3a4ea75453821d0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\410d8952f780ac45e3a4ea75453821d0_NEIKI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 36
  2⤵
  - Program crash
  PID:1516

memory/2892-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download