7bd4a4ea98d2ab556b97b0ef2df285e64ba750ed4511b14e664c249e27d77e91

Analysis

max time kernel
133s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 02:09

Target

89762dfb02e0a748df513527cd81aaa0_NeikiAnalytics.exe
Size

107KB
MD5

89762dfb02e0a748df513527cd81aaa0
SHA1

9e01f888714d51c39f203afe0e4a3bd8414df598
SHA256

7bd4a4ea98d2ab556b97b0ef2df285e64ba750ed4511b14e664c249e27d77e91
SHA512

228906cbf231d3f521ed2f2a135398e52acdfac354bfb1da78d217213a8c4abd982855d83c4e2b1bbc0741e34cda084610407948086b1c24a9c37e3f4897b530
SSDEEP

3072:REhLjKY6CnK4cT6HKBmg0crZA2fdmpmtKmfp:WjK6cWvcri2fdKE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4340	2936	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2936	2828	regsvr32.exe	90
PID 2828 wrote to memory of 2936	2828	regsvr32.exe	90
PID 2828 wrote to memory of 2936	2828	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\89762dfb02e0a748df513527cd81aaa0_NeikiAnalytics.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\89762dfb02e0a748df513527cd81aaa0_NeikiAnalytics.exe
  2⤵
  PID:2936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 600
    3⤵
    - Program crash
    PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2936 -ip 2936
1⤵
PID:916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:8
1⤵
PID:3196