7bd4a4ea98d2ab556b97b0ef2df285e64ba750ed4511b14e664c249e27d77e91

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 02:09

Target

89762dfb02e0a748df513527cd81aaa0_NeikiAnalytics.exe
Size

107KB
MD5

89762dfb02e0a748df513527cd81aaa0
SHA1

9e01f888714d51c39f203afe0e4a3bd8414df598
SHA256

7bd4a4ea98d2ab556b97b0ef2df285e64ba750ed4511b14e664c249e27d77e91
SHA512

228906cbf231d3f521ed2f2a135398e52acdfac354bfb1da78d217213a8c4abd982855d83c4e2b1bbc0741e34cda084610407948086b1c24a9c37e3f4897b530
SSDEEP

3072:REhLjKY6CnK4cT6HKBmg0crZA2fdmpmtKmfp:WjK6cWvcri2fdKE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2824	1856	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 1856	1040	regsvr32.exe	28
PID 1040 wrote to memory of 1856	1040	regsvr32.exe	28
PID 1040 wrote to memory of 1856	1040	regsvr32.exe	28
PID 1040 wrote to memory of 1856	1040	regsvr32.exe	28
PID 1040 wrote to memory of 1856	1040	regsvr32.exe	28
PID 1040 wrote to memory of 1856	1040	regsvr32.exe	28
PID 1040 wrote to memory of 1856	1040	regsvr32.exe	28
PID 1856 wrote to memory of 2824	1856	regsvr32.exe	29
PID 1856 wrote to memory of 2824	1856	regsvr32.exe	29
PID 1856 wrote to memory of 2824	1856	regsvr32.exe	29
PID 1856 wrote to memory of 2824	1856	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\89762dfb02e0a748df513527cd81aaa0_NeikiAnalytics.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\89762dfb02e0a748df513527cd81aaa0_NeikiAnalytics.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 292
    3⤵
    - Program crash
    PID:2824