03324c52fb47356c6f8967b3c2b6208e9cde37e2ee5e13f496e9a0c58c6b217e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 04:52

Target

77f881ce8a13393279aa4641e0fb1280_NeikiAnalytics.exe
Size

107KB
MD5

77f881ce8a13393279aa4641e0fb1280
SHA1

70fda542679054b251b492f7286eb471cd21bc0f
SHA256

03324c52fb47356c6f8967b3c2b6208e9cde37e2ee5e13f496e9a0c58c6b217e
SHA512

1d570cc6ff8ac8ac9f8a466b7c6cb3e6f21b1043afdac1362bcdfaca9fd95719073408aabfde4191b58be0dc16629fa42a7cb83523b3ed16d85176a6daf8c4d7
SSDEEP

3072:REhLjKU6CnK4cT6HKBmg0crZA2fdmpmtEmfp:WjKucWvcri2fdK+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1164	3308	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 680 wrote to memory of 3308	680	regsvr32.exe	82
PID 680 wrote to memory of 3308	680	regsvr32.exe	82
PID 680 wrote to memory of 3308	680	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\77f881ce8a13393279aa4641e0fb1280_NeikiAnalytics.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:680
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\77f881ce8a13393279aa4641e0fb1280_NeikiAnalytics.exe
  2⤵
  PID:3308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 600
    3⤵
    - Program crash
    PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3308 -ip 3308
1⤵
PID:2512