2db184ab52d1b2353f31049541b4e873e1be865345cec5e8fc2ba9c5db163931

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 03:52

Target

e5698ff6f6d90a9ccf6587e999cd9df0_NEIKI.exe
Size

208KB
MD5

e5698ff6f6d90a9ccf6587e999cd9df0
SHA1

5bf40862acb17fef97a53e37ab6e7c611277153d
SHA256

2db184ab52d1b2353f31049541b4e873e1be865345cec5e8fc2ba9c5db163931
SHA512

818243d9de8b6e5d15270db58429141a4aba145ad2d9deb31ef43bd703a9ee949baae38fcf49e492e190e965799d7d1658afd48981bb38a3144ddb3eaf7208e1
SSDEEP

1536:fUDRi9T5sJdi9bxHNr2pnx6KaUuP6iuwJRF0OWeXiH3:f8RinudiP52xx67lLdhniH3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2412	1948	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2412	1948	e5698ff6f6d90a9ccf6587e999cd9df0_NEIKI.exe	28
PID 1948 wrote to memory of 2412	1948	e5698ff6f6d90a9ccf6587e999cd9df0_NEIKI.exe	28
PID 1948 wrote to memory of 2412	1948	e5698ff6f6d90a9ccf6587e999cd9df0_NEIKI.exe	28
PID 1948 wrote to memory of 2412	1948	e5698ff6f6d90a9ccf6587e999cd9df0_NEIKI.exe	28

C:\Users\Admin\AppData\Local\Temp\e5698ff6f6d90a9ccf6587e999cd9df0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\e5698ff6f6d90a9ccf6587e999cd9df0_NEIKI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 36
  2⤵
  - Program crash
  PID:2412

memory/1948-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download