7d4ac974fc44c9506e6f5cd87733de4c36dc331e41c60e3c03eceafb38d9058d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 20:58

Target

4e398ef1ac9e86a11a1488cfc623b1a0_NEIKI.exe
Size

472KB
MD5

4e398ef1ac9e86a11a1488cfc623b1a0
SHA1

5ff1830b727c2dfdb7879a54cab38fdce6d35d3a
SHA256

7d4ac974fc44c9506e6f5cd87733de4c36dc331e41c60e3c03eceafb38d9058d
SHA512

aab389744d35b3a1b673b107377f575916858dc9a00b1a4e4b474de5d33a983da9fccdd470db33325dc717d336723986f8e3df2bca27b98a43e5b992228f3610
SSDEEP

3072:uN8RinudiP52xx67lLdtiHDo9JE2Nm2AYoFfdVFov:5kgiPA6RjPA2Nm2A/VdEv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2964	2904	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2964	2904	4e398ef1ac9e86a11a1488cfc623b1a0_NEIKI.exe	28
PID 2904 wrote to memory of 2964	2904	4e398ef1ac9e86a11a1488cfc623b1a0_NEIKI.exe	28
PID 2904 wrote to memory of 2964	2904	4e398ef1ac9e86a11a1488cfc623b1a0_NEIKI.exe	28
PID 2904 wrote to memory of 2964	2904	4e398ef1ac9e86a11a1488cfc623b1a0_NEIKI.exe	28

C:\Users\Admin\AppData\Local\Temp\4e398ef1ac9e86a11a1488cfc623b1a0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\4e398ef1ac9e86a11a1488cfc623b1a0_NEIKI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 36
  2⤵
  - Program crash
  PID:2964

memory/2904-1-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download