81d1c0087a9cff30fb158b894f5cdd3a4d0099dbb8951fe2d02db9390b6e323c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 01:30

Target

15328dc6c30a6303be27e74a0ac2da80_NeikiAnalytics.exe
Size

108KB
MD5

15328dc6c30a6303be27e74a0ac2da80
SHA1

58a67b78c03d7609861db1bf21f123c1a2ec7775
SHA256

81d1c0087a9cff30fb158b894f5cdd3a4d0099dbb8951fe2d02db9390b6e323c
SHA512

7d01ed6c5209b3d9461ccaa25362935de712bc638af0cd538f4dd5e4f8c7322c632ac2924304cbb33c473abe38c6d8186f824eef3c2c32065145747c1313d4b6
SSDEEP

1536:Vc6DhIB5qgjIlcmzeGmAUxySq8ARDms3EqpG2jdg/PmpmhLG:Vc6Dhuh8lcmz0MRDms3Zw2i3mpmhK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2144	1752	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 1752	1804	regsvr32.exe	28
PID 1804 wrote to memory of 1752	1804	regsvr32.exe	28
PID 1804 wrote to memory of 1752	1804	regsvr32.exe	28
PID 1804 wrote to memory of 1752	1804	regsvr32.exe	28
PID 1804 wrote to memory of 1752	1804	regsvr32.exe	28
PID 1804 wrote to memory of 1752	1804	regsvr32.exe	28
PID 1804 wrote to memory of 1752	1804	regsvr32.exe	28
PID 1752 wrote to memory of 2144	1752	regsvr32.exe	29
PID 1752 wrote to memory of 2144	1752	regsvr32.exe	29
PID 1752 wrote to memory of 2144	1752	regsvr32.exe	29
PID 1752 wrote to memory of 2144	1752	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\15328dc6c30a6303be27e74a0ac2da80_NeikiAnalytics.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\15328dc6c30a6303be27e74a0ac2da80_NeikiAnalytics.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 292
    3⤵
    - Program crash
    PID:2144