45345a2b35769c703ca120be4dd6c46b0de85bc6dfcce0b19622ad67f0e16bde

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 22:10

Target

4af6f3bb5dbc0620e2062e8cd2bceeb0_NEIKI.exe
Size

976KB
MD5

4af6f3bb5dbc0620e2062e8cd2bceeb0
SHA1

6f711ffe250ac82eca38c67516d80df26be7b92e
SHA256

45345a2b35769c703ca120be4dd6c46b0de85bc6dfcce0b19622ad67f0e16bde
SHA512

cd42848fabcbbae3d030777d3da89234e9d091eae0377c69b4ab5fc3d9e5543a709fa213f624cdf10b24a4a8bd25d56f10b446b773442af6ea175008cd2c608a
SSDEEP

24576:yc+lPYVMQRlTH35DMw2n/qIjtAT3Goss86TYA:yv4z35DMnCIjtAyoss1TJ

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1028	dw20.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1028	2180	4af6f3bb5dbc0620e2062e8cd2bceeb0_NEIKI.exe	29
PID 2180 wrote to memory of 1028	2180	4af6f3bb5dbc0620e2062e8cd2bceeb0_NEIKI.exe	29
PID 2180 wrote to memory of 1028	2180	4af6f3bb5dbc0620e2062e8cd2bceeb0_NEIKI.exe	29
PID 2180 wrote to memory of 1028	2180	4af6f3bb5dbc0620e2062e8cd2bceeb0_NEIKI.exe	29

C:\Users\Admin\AppData\Local\Temp\4af6f3bb5dbc0620e2062e8cd2bceeb0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\4af6f3bb5dbc0620e2062e8cd2bceeb0_NEIKI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 964
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1028

memory/1028-12-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/1028-14-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/2180-0-0x00000000740A1000-0x00000000740A2000-memory.dmp

Filesize
4KB

Download
memory/2180-1-0x00000000740A0000-0x000000007464B000-memory.dmp

Filesize
5.7MB

Download
memory/2180-2-0x00000000740A0000-0x000000007464B000-memory.dmp

Filesize
5.7MB

Download
memory/2180-13-0x00000000740A0000-0x000000007464B000-memory.dmp

Filesize
5.7MB

Download