24d6cd6bbeccc40113e384c5701c15ff1c3da8b9716a106e50d6998310f9721d

Analysis

max time kernel
144s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 21:54

Target

69d23af148127ee8635ce7641e023440_NeikiAnalytics.exe
Size

107KB
MD5

69d23af148127ee8635ce7641e023440
SHA1

24a30218630949e2271e0dbef96c3dcdd099e30b
SHA256

24d6cd6bbeccc40113e384c5701c15ff1c3da8b9716a106e50d6998310f9721d
SHA512

e3322a10b50f66db41e8dd8ab7a68637264f75cc343d67e2d65089a259d3a1d86d1f1d7ac3693e0b543a54d75456e8ccaa6db88be89427fe3a21625f1bc91b36
SSDEEP

3072:REhLjK86CnK4cT6HKBmg0crZA2fdmpmtpmfp:WjK2cWvcri2fdKD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2772	3516	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 3516	1852	regsvr32.exe	83
PID 1852 wrote to memory of 3516	1852	regsvr32.exe	83
PID 1852 wrote to memory of 3516	1852	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\69d23af148127ee8635ce7641e023440_NeikiAnalytics.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\69d23af148127ee8635ce7641e023440_NeikiAnalytics.exe
  2⤵
  PID:3516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 608
    3⤵
    - Program crash
    PID:2772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3516 -ip 3516
1⤵
PID:740