fa0e59ff8a0364fb2946888b9e4565d42f83436ff955b2a474d325702dc1b1a9

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 03:12

Target
59727d0b777b471e2545e4a7533aa390_NeikiAnalytics.exe
Size 107KB
Sample240526-dp89psde65
SHA256 fa0e59ff8a0364fb2946888b9e4565d42f83436ff955b2a474d325702dc1b1a9
MD5 59727d0b777b471e2545e4a7533aa390
SHA1 b1adcc5a0a63ed40e6c881d1c5e7f57efb0d51d8
SHA512 78bd4bb44179480db3f2da70bb45d131123b67672fdaa936a4b2d2bec985f6844108e2175bf6939951d53e0e2d44a47ab912b4d9bc5e3e6d57d001437e47a66a
SSDEEP 3072:REhLjKw6CnK4cT6HKBmg0crZA2fdmpmt/mfp:WjKycWvcri2fdKt
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3016	2984	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2984	2764	regsvr32.exe	84
PID 2764 wrote to memory of 2984	2764	regsvr32.exe	84
PID 2764 wrote to memory of 2984	2764	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\59727d0b777b471e2545e4a7533aa390_NeikiAnalytics.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\59727d0b777b471e2545e4a7533aa390_NeikiAnalytics.exe
  2⤵
  PID:2984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 600
    3⤵
    - Program crash
    PID:3016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2984 -ip 2984
1⤵
PID:4032