81d1c0087a9cff30fb158b894f5cdd3a4d0099dbb8951fe2d02db9390b6e323c

Analysis

max time kernel
111s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 01:30

Target

15328dc6c30a6303be27e74a0ac2da80_NeikiAnalytics.exe
Size

108KB
MD5

15328dc6c30a6303be27e74a0ac2da80
SHA1

58a67b78c03d7609861db1bf21f123c1a2ec7775
SHA256

81d1c0087a9cff30fb158b894f5cdd3a4d0099dbb8951fe2d02db9390b6e323c
SHA512

7d01ed6c5209b3d9461ccaa25362935de712bc638af0cd538f4dd5e4f8c7322c632ac2924304cbb33c473abe38c6d8186f824eef3c2c32065145747c1313d4b6
SSDEEP

1536:Vc6DhIB5qgjIlcmzeGmAUxySq8ARDms3EqpG2jdg/PmpmhLG:Vc6Dhuh8lcmz0MRDms3Zw2i3mpmhK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3816	1652	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 1652	5100	regsvr32.exe	90
PID 5100 wrote to memory of 1652	5100	regsvr32.exe	90
PID 5100 wrote to memory of 1652	5100	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\15328dc6c30a6303be27e74a0ac2da80_NeikiAnalytics.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\15328dc6c30a6303be27e74a0ac2da80_NeikiAnalytics.exe
  2⤵
  PID:1652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 600
    3⤵
    - Program crash
    PID:3816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1652 -ip 1652
1⤵
PID:2732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:2904