ade81baef4926f4fb98ad5589bc5aafd466a90ff3ac9b0f6a40130b1571a75bd

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 01:36

Target

5ee5d7b3633e51e4feaa1916cd141d60_NeikiAnalytics.exe
Size

107KB
MD5

5ee5d7b3633e51e4feaa1916cd141d60
SHA1

ea20d82c6f15c820f7fd8c27e4122da26ee20e91
SHA256

ade81baef4926f4fb98ad5589bc5aafd466a90ff3ac9b0f6a40130b1571a75bd
SHA512

7a5daf1d1e2cebe06e2720442c520531d7466ee458c56c6b7e040e67065a129b0b676ca936e47cf81a98f43126b4535779d864c39fd5fef7b0709198637d6f18
SSDEEP

3072:REhLjKF6CnK4cT6HKBmg0crXz2fdmpmtzufp:WjK/cWvcrj2fdKZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
928	4660	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 4660	1188	regsvr32.exe	89
PID 1188 wrote to memory of 4660	1188	regsvr32.exe	89
PID 1188 wrote to memory of 4660	1188	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5ee5d7b3633e51e4feaa1916cd141d60_NeikiAnalytics.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\5ee5d7b3633e51e4feaa1916cd141d60_NeikiAnalytics.exe
  2⤵
  PID:4660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 600
    3⤵
    - Program crash
    PID:928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4660 -ip 4660
1⤵
PID:1308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:2044