d6cd3d7240e5ba777d8d639c00bd0d91a87778f551d6d9be5639bb81f9df4127

Analysis

max time kernel
94s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 22:23

Target

07902532966063db4a7f90555f42c6c0_NeikiAnalytics.exe
Size

107KB
MD5

07902532966063db4a7f90555f42c6c0
SHA1

8e8d7cf231ea2b74374f6e890a92630665feefa6
SHA256

d6cd3d7240e5ba777d8d639c00bd0d91a87778f551d6d9be5639bb81f9df4127
SHA512

967cdefe1c8ac77cf91f20c3ecd741343feb635c537c7decb439b81714297ecfaed6679157fff441e9bd75ff097ef7f8f871bd53eb74464749678e944c1f59f6
SSDEEP

3072:REhLjKI6CnK4cT6HKBmg0crZA2fdmpmt+mfp:WjKqcWvcri2fdKE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4472	4296	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 4296	1020	regsvr32.exe	82
PID 1020 wrote to memory of 4296	1020	regsvr32.exe	82
PID 1020 wrote to memory of 4296	1020	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\07902532966063db4a7f90555f42c6c0_NeikiAnalytics.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\07902532966063db4a7f90555f42c6c0_NeikiAnalytics.exe
  2⤵
  PID:4296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 600
    3⤵
    - Program crash
    PID:4472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4296 -ip 4296
1⤵
PID:1368