d6cd3d7240e5ba777d8d639c00bd0d91a87778f551d6d9be5639bb81f9df4127

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 22:23

Target

07902532966063db4a7f90555f42c6c0_NeikiAnalytics.exe
Size

107KB
MD5

07902532966063db4a7f90555f42c6c0
SHA1

8e8d7cf231ea2b74374f6e890a92630665feefa6
SHA256

d6cd3d7240e5ba777d8d639c00bd0d91a87778f551d6d9be5639bb81f9df4127
SHA512

967cdefe1c8ac77cf91f20c3ecd741343feb635c537c7decb439b81714297ecfaed6679157fff441e9bd75ff097ef7f8f871bd53eb74464749678e944c1f59f6
SSDEEP

3072:REhLjKI6CnK4cT6HKBmg0crZA2fdmpmt+mfp:WjKqcWvcri2fdKE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2752	1144	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1144	1760	regsvr32.exe	28
PID 1760 wrote to memory of 1144	1760	regsvr32.exe	28
PID 1760 wrote to memory of 1144	1760	regsvr32.exe	28
PID 1760 wrote to memory of 1144	1760	regsvr32.exe	28
PID 1760 wrote to memory of 1144	1760	regsvr32.exe	28
PID 1760 wrote to memory of 1144	1760	regsvr32.exe	28
PID 1760 wrote to memory of 1144	1760	regsvr32.exe	28
PID 1144 wrote to memory of 2752	1144	regsvr32.exe	29
PID 1144 wrote to memory of 2752	1144	regsvr32.exe	29
PID 1144 wrote to memory of 2752	1144	regsvr32.exe	29
PID 1144 wrote to memory of 2752	1144	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\07902532966063db4a7f90555f42c6c0_NeikiAnalytics.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\07902532966063db4a7f90555f42c6c0_NeikiAnalytics.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 292
    3⤵
    - Program crash
    PID:2752