775261ac4274392de5fef0b2054dc6656c7d4a392167cd18a9f6125d05c676ab

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22-04-2024 01:52

Target

Lua Injector Universe/NeutrinoInjector.exe
Size

159KB
MD5

3d3e59a445f716de310d2c2b09c2d235
SHA1

4e62578c1fec3b12d15c12a88b7b56980136f23e
SHA256

3bd7bc7dcadce9331ad1d51cb865552f1d78d8a7474f847055a32f47fb2de86b
SHA512

3effe7a7486743a48fd670cc8ff9b01b42bc8f1680c67cc004ec66cbeff87bf8a1ed2b4a1074bbac39e60fd591e27041cf8a10582bde250ac6d92b092fa5d197
SSDEEP

3072:f0YMMF6/ZP6Agq3SaS2HuFuFspnZ+6U9N7yr5S/PLtpDvkmftMwvjtqwMcpoQK1:8YMMF6xkq3SaS2HqCs1ZFU99y2DvrtIG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

NeutrinoInjector.exe

description	pid	process	target process
PID 4956 wrote to memory of 4192	4956	NeutrinoInjector.exe	cmd.exe
PID 4956 wrote to memory of 4192	4956	NeutrinoInjector.exe	cmd.exe
PID 4956 wrote to memory of 4192	4956	NeutrinoInjector.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\Lua Injector Universe\NeutrinoInjector.exe
"C:\Users\Admin\AppData\Local\Temp\Lua Injector Universe\NeutrinoInjector.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c color 5F
  2⤵
  PID:4192