b1a9646141914fce9ad3d937c8fbed2f305fdcaff959be546063e4f5b7ee7893

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 20:56

Target

4dbead4d1430b99d03a281bbd1679c20_NEIKI.exe
Size

264KB
MD5

4dbead4d1430b99d03a281bbd1679c20
SHA1

5512fba5a0c48aca1b6793df4a0e439eadec505a
SHA256

b1a9646141914fce9ad3d937c8fbed2f305fdcaff959be546063e4f5b7ee7893
SHA512

8d493f6eb1f05a93cd0c875a33e35c62ca8fcc4b37e731196e1d2fb4de41efa6735f9d59f6bc6ca794111e83cf2f4b2d22cd107104128df3d8250b73d7757892
SSDEEP

1536:YsASwKScoNSLDhm59wtzVkDBZDYizaLIH3mFh4iSDo/c:YBSwx8Hhm59wtY9YSaLRFh48/c

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2140	2136	WerFault.exe	28

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2140	2136	4dbead4d1430b99d03a281bbd1679c20_NEIKI.exe	29
PID 2136 wrote to memory of 2140	2136	4dbead4d1430b99d03a281bbd1679c20_NEIKI.exe	29
PID 2136 wrote to memory of 2140	2136	4dbead4d1430b99d03a281bbd1679c20_NEIKI.exe	29
PID 2136 wrote to memory of 2140	2136	4dbead4d1430b99d03a281bbd1679c20_NEIKI.exe	29

C:\Users\Admin\AppData\Local\Temp\4dbead4d1430b99d03a281bbd1679c20_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\4dbead4d1430b99d03a281bbd1679c20_NEIKI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 36
  2⤵
  - Program crash
  PID:2140

memory/2136-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download