ade81baef4926f4fb98ad5589bc5aafd466a90ff3ac9b0f6a40130b1571a75bd

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 01:36

Target

5ee5d7b3633e51e4feaa1916cd141d60_NeikiAnalytics.exe
Size

107KB
MD5

5ee5d7b3633e51e4feaa1916cd141d60
SHA1

ea20d82c6f15c820f7fd8c27e4122da26ee20e91
SHA256

ade81baef4926f4fb98ad5589bc5aafd466a90ff3ac9b0f6a40130b1571a75bd
SHA512

7a5daf1d1e2cebe06e2720442c520531d7466ee458c56c6b7e040e67065a129b0b676ca936e47cf81a98f43126b4535779d864c39fd5fef7b0709198637d6f18
SSDEEP

3072:REhLjKF6CnK4cT6HKBmg0crXz2fdmpmtzufp:WjK/cWvcrj2fdKZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2100	2096	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2096	1968	regsvr32.exe	28
PID 1968 wrote to memory of 2096	1968	regsvr32.exe	28
PID 1968 wrote to memory of 2096	1968	regsvr32.exe	28
PID 1968 wrote to memory of 2096	1968	regsvr32.exe	28
PID 1968 wrote to memory of 2096	1968	regsvr32.exe	28
PID 1968 wrote to memory of 2096	1968	regsvr32.exe	28
PID 1968 wrote to memory of 2096	1968	regsvr32.exe	28
PID 2096 wrote to memory of 2100	2096	regsvr32.exe	29
PID 2096 wrote to memory of 2100	2096	regsvr32.exe	29
PID 2096 wrote to memory of 2100	2096	regsvr32.exe	29
PID 2096 wrote to memory of 2100	2096	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5ee5d7b3633e51e4feaa1916cd141d60_NeikiAnalytics.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5ee5d7b3633e51e4feaa1916cd141d60_NeikiAnalytics.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 292
    3⤵
    - Program crash
    PID:2100