085052c00f78a9297b2515c1aa83cab6003f50e12a10029b5358b4bf9795606f

Analysis

max time kernel
140s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 22:49

Target

86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe
Size

42KB
MD5

86318ed39f8d574900b97bc9a76d96d0
SHA1

22efaac366accb7080eec81e0636818858d86703
SHA256

085052c00f78a9297b2515c1aa83cab6003f50e12a10029b5358b4bf9795606f
SHA512

88d09bfd18e5586afaa7ba0f90ddaccf8cc6a6070ee03eb4c1b65a70b7b08e71b236e9c3c68fe989a2e805b49fa712d7323da68bcc8eed61574acacd03cbf115
SSDEEP

768:iFqxSxQQ87RAjLf8KW2wWSoXx2K3wd272uic:iY8xQQQkLpwW/2KAZuj

Score

1^/10

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 4248	3840	86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe	79
PID 3840 wrote to memory of 4248	3840	86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe	79
PID 3840 wrote to memory of 4248	3840	86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe	79
PID 4248 wrote to memory of 1508	4248	cmd.exe	80
PID 4248 wrote to memory of 1508	4248	cmd.exe	80
PID 4248 wrote to memory of 1508	4248	cmd.exe	80
PID 3840 wrote to memory of 3732	3840	86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe	81
PID 3840 wrote to memory of 3732	3840	86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe	81
PID 3840 wrote to memory of 3732	3840	86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe	81
PID 3840 wrote to memory of 5104	3840	86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe	82
PID 3840 wrote to memory of 5104	3840	86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe	82
PID 3840 wrote to memory of 5104	3840	86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe	82

C:\Users\Admin\AppData\Local\Temp\86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\86318ed39f8d574900b97bc9a76d96d0_NEIKI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c chcp 1251 > NULL
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\SysWOW64\chcp.com
    chcp 1251
    3⤵
    PID:1508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:3732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5104

memory/3840-1-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download