6fe5d13da2832bddb4a654acf98d471db9f2f0e7d73993d4701c76e14770a488

Analysis

max time kernel
141s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 20:13

Target

1f7d5c41c77dece05b17edd609730b20_NEIKI.exe
Size

79KB
MD5

1f7d5c41c77dece05b17edd609730b20
SHA1

72066c8ac3c9e0709e611280cd1f93840d13a341
SHA256

6fe5d13da2832bddb4a654acf98d471db9f2f0e7d73993d4701c76e14770a488
SHA512

6718479e06ff9e300566b84689bc16915c6e4a6cd3587fbe7480dfbf37a10e455d1ac530f0489508716addf202738a375023a306201fa5d9d8639731e0a752ec
SSDEEP

1536:zvYONtUW2tbTs1OQA8AkqUhMb2nuy5wgIP0CSJ+5y6MB8GMGlZ5G:zvYODUTpfGdqU7uy5w9WMy6MN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4424	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 5112	3216	1f7d5c41c77dece05b17edd609730b20_NEIKI.exe	86
PID 3216 wrote to memory of 5112	3216	1f7d5c41c77dece05b17edd609730b20_NEIKI.exe	86
PID 3216 wrote to memory of 5112	3216	1f7d5c41c77dece05b17edd609730b20_NEIKI.exe	86
PID 5112 wrote to memory of 4424	5112	cmd.exe	87
PID 5112 wrote to memory of 4424	5112	cmd.exe	87
PID 5112 wrote to memory of 4424	5112	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\1f7d5c41c77dece05b17edd609730b20_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\1f7d5c41c77dece05b17edd609730b20_NEIKI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:4424

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
9637f9c964258932aecf3e5faa162f66

SHA1
469d160c08483f655995bed11822601c65eedd8a

SHA256
aa0ded7ea98b7e88d5a1f4cce5f635afa315849bb8b19483915bbf19c589794b

SHA512
fc07dd6351b855f23ffd4ac646096fbc6f7fd96b9cbb2f554a4dc90b3afa43506395e8eba2552513a45895843f803c1194005f74a7652b8bf5fb3201ad44cd73

Download Submit
memory/3216-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4424-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download