085052c00f78a9297b2515c1aa83cab6003f50e12a10029b5358b4bf9795606f

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 22:49

Target

86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe
Size

42KB
MD5

86318ed39f8d574900b97bc9a76d96d0
SHA1

22efaac366accb7080eec81e0636818858d86703
SHA256

085052c00f78a9297b2515c1aa83cab6003f50e12a10029b5358b4bf9795606f
SHA512

88d09bfd18e5586afaa7ba0f90ddaccf8cc6a6070ee03eb4c1b65a70b7b08e71b236e9c3c68fe989a2e805b49fa712d7323da68bcc8eed61574acacd03cbf115
SSDEEP

768:iFqxSxQQ87RAjLf8KW2wWSoXx2K3wd272uic:iY8xQQQkLpwW/2KAZuj

Score

1^/10

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 1228	1200	86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe	29
PID 1200 wrote to memory of 1228	1200	86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe	29
PID 1200 wrote to memory of 1228	1200	86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe	29
PID 1200 wrote to memory of 1228	1200	86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe	29
PID 1228 wrote to memory of 1400	1228	cmd.exe	30
PID 1228 wrote to memory of 1400	1228	cmd.exe	30
PID 1228 wrote to memory of 1400	1228	cmd.exe	30
PID 1228 wrote to memory of 1400	1228	cmd.exe	30
PID 1200 wrote to memory of 2084	1200	86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe	31
PID 1200 wrote to memory of 2084	1200	86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe	31
PID 1200 wrote to memory of 2084	1200	86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe	31
PID 1200 wrote to memory of 2084	1200	86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe	31
PID 1200 wrote to memory of 2572	1200	86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe	32
PID 1200 wrote to memory of 2572	1200	86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe	32
PID 1200 wrote to memory of 2572	1200	86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe	32
PID 1200 wrote to memory of 2572	1200	86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe	32

C:\Users\Admin\AppData\Local\Temp\86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c chcp 1251 > NULL
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\SysWOW64\chcp.com
    chcp 1251
    3⤵
    PID:1400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2572

memory/1200-1-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download