24d6cd6bbeccc40113e384c5701c15ff1c3da8b9716a106e50d6998310f9721d

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 21:54

Target

69d23af148127ee8635ce7641e023440_NeikiAnalytics.exe
Size

107KB
MD5

69d23af148127ee8635ce7641e023440
SHA1

24a30218630949e2271e0dbef96c3dcdd099e30b
SHA256

24d6cd6bbeccc40113e384c5701c15ff1c3da8b9716a106e50d6998310f9721d
SHA512

e3322a10b50f66db41e8dd8ab7a68637264f75cc343d67e2d65089a259d3a1d86d1f1d7ac3693e0b543a54d75456e8ccaa6db88be89427fe3a21625f1bc91b36
SSDEEP

3072:REhLjK86CnK4cT6HKBmg0crZA2fdmpmtpmfp:WjK2cWvcri2fdKD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3004	2252	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2252	2188	regsvr32.exe	28
PID 2188 wrote to memory of 2252	2188	regsvr32.exe	28
PID 2188 wrote to memory of 2252	2188	regsvr32.exe	28
PID 2188 wrote to memory of 2252	2188	regsvr32.exe	28
PID 2188 wrote to memory of 2252	2188	regsvr32.exe	28
PID 2188 wrote to memory of 2252	2188	regsvr32.exe	28
PID 2188 wrote to memory of 2252	2188	regsvr32.exe	28
PID 2252 wrote to memory of 3004	2252	regsvr32.exe	29
PID 2252 wrote to memory of 3004	2252	regsvr32.exe	29
PID 2252 wrote to memory of 3004	2252	regsvr32.exe	29
PID 2252 wrote to memory of 3004	2252	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\69d23af148127ee8635ce7641e023440_NeikiAnalytics.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\69d23af148127ee8635ce7641e023440_NeikiAnalytics.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 292
    3⤵
    - Program crash
    PID:3004