0ac7896db6986d97e9d97d7e52d183a5fdf3d57c4e932bfedc596c695c10d69f

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 20:26

Target

998fea7a62f920ac535d65d3ba984b30_NeikiAnalytics.exe
Size

107KB
MD5

998fea7a62f920ac535d65d3ba984b30
SHA1

1cece8a80497dff1eb6bb8b6a76bcd434029e8e4
SHA256

0ac7896db6986d97e9d97d7e52d183a5fdf3d57c4e932bfedc596c695c10d69f
SHA512

3f6b1a3d535819422bb3f9f98c5a96fdd1f1b31bb4b34ff736a5fb392c5359f272bb1ff69928a890a97ae587d54cd0d4479d23ae8ba4f34765d243414fb6fb9b
SSDEEP

3072:REhLjKs6CnK4cT6HKBmg0crZA2fdmpmtxmfp:WjKmcWvcri2fdKf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
532	3040	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 3040	2260	regsvr32.exe	91
PID 2260 wrote to memory of 3040	2260	regsvr32.exe	91
PID 2260 wrote to memory of 3040	2260	regsvr32.exe	91

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\998fea7a62f920ac535d65d3ba984b30_NeikiAnalytics.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\998fea7a62f920ac535d65d3ba984b30_NeikiAnalytics.exe
  2⤵
  PID:3040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 600
    3⤵
    - Program crash
    PID:532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 3040 -ip 3040
1⤵
PID:5276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1324 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:3576