bd3ea080af8a0a336d4bc3bfe1be29bf93f38d83c990ae71cf78f71cec1ae71f

Analysis

max time kernel
132s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 22:01

Target

4782cd4411e147c52b734be1930091f0_NEIKI.exe
Size

9.0MB
MD5

4782cd4411e147c52b734be1930091f0
SHA1

03609ede6ef1dd0bd9919d307e699481bd7f67db
SHA256

bd3ea080af8a0a336d4bc3bfe1be29bf93f38d83c990ae71cf78f71cec1ae71f
SHA512

9a95eaf84eefb7304f52054587c2fe5e86b4a1f0dbd28b3ea23767e526ef6f6408410f037bca8786277f68442e1105eb104a78ee96560b04c5691bdc77c5bfa6
SSDEEP

196608:eWpeCX8AjcWfh7t4fZWZPagPxijQtgFRbUaVNS:eW4CXtb4fj4xwEqRz

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 4544	4824	4782cd4411e147c52b734be1930091f0_NEIKI.exe	86
PID 4824 wrote to memory of 4544	4824	4782cd4411e147c52b734be1930091f0_NEIKI.exe	86

C:\Users\Admin\AppData\Local\Temp\4782cd4411e147c52b734be1930091f0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\4782cd4411e147c52b734be1930091f0_NEIKI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  PID:4544

memory/4824-0-0x00007FFA76070000-0x00007FFA76265000-memory.dmp

Filesize
2.0MB

Download
memory/4824-1-0x000001D2E9CB0000-0x000001D2E9E03000-memory.dmp

Filesize
1.3MB

Download