03324c52fb47356c6f8967b3c2b6208e9cde37e2ee5e13f496e9a0c58c6b217e

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 04:52

Target

77f881ce8a13393279aa4641e0fb1280_NeikiAnalytics.exe
Size

107KB
MD5

77f881ce8a13393279aa4641e0fb1280
SHA1

70fda542679054b251b492f7286eb471cd21bc0f
SHA256

03324c52fb47356c6f8967b3c2b6208e9cde37e2ee5e13f496e9a0c58c6b217e
SHA512

1d570cc6ff8ac8ac9f8a466b7c6cb3e6f21b1043afdac1362bcdfaca9fd95719073408aabfde4191b58be0dc16629fa42a7cb83523b3ed16d85176a6daf8c4d7
SSDEEP

3072:REhLjKU6CnK4cT6HKBmg0crZA2fdmpmtEmfp:WjKucWvcri2fdK+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1300	1712	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 1712	2620	regsvr32.exe	28
PID 2620 wrote to memory of 1712	2620	regsvr32.exe	28
PID 2620 wrote to memory of 1712	2620	regsvr32.exe	28
PID 2620 wrote to memory of 1712	2620	regsvr32.exe	28
PID 2620 wrote to memory of 1712	2620	regsvr32.exe	28
PID 2620 wrote to memory of 1712	2620	regsvr32.exe	28
PID 2620 wrote to memory of 1712	2620	regsvr32.exe	28
PID 1712 wrote to memory of 1300	1712	regsvr32.exe	29
PID 1712 wrote to memory of 1300	1712	regsvr32.exe	29
PID 1712 wrote to memory of 1300	1712	regsvr32.exe	29
PID 1712 wrote to memory of 1300	1712	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\77f881ce8a13393279aa4641e0fb1280_NeikiAnalytics.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\77f881ce8a13393279aa4641e0fb1280_NeikiAnalytics.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 292
    3⤵
    - Program crash
    PID:1300