dd20ab603ad9fe9d0d468d40b08b338dac3a3c37a9f2bed1e85558f97abbd450

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 01:51

Target

9be92c18f41fd6033ef1ce78a49b7930_NEIKI.exe
Size

73KB
MD5

9be92c18f41fd6033ef1ce78a49b7930
SHA1

3a6f1458d930dc5c53a7c4fbfb1d3c8fb9a6bded
SHA256

dd20ab603ad9fe9d0d468d40b08b338dac3a3c37a9f2bed1e85558f97abbd450
SHA512

6b4522814d7b3b668734b5acd597ea6b94e4fffc27afb92766e34665db2f39471a585e145af863b5f62003c56fc6aea343dbcb8cca960697596c5b34ceff042c
SSDEEP

1536:hbokyO8MUh6K5QPqfhVWbdsmA+RjPFLC+e5hPy0ZGUGf2g:hcrO7Uh6NPqfcxA+HFshKOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1996	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
1636	cmd.exe
1636	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 1636	2868	9be92c18f41fd6033ef1ce78a49b7930_NEIKI.exe	29
PID 2868 wrote to memory of 1636	2868	9be92c18f41fd6033ef1ce78a49b7930_NEIKI.exe	29
PID 2868 wrote to memory of 1636	2868	9be92c18f41fd6033ef1ce78a49b7930_NEIKI.exe	29
PID 2868 wrote to memory of 1636	2868	9be92c18f41fd6033ef1ce78a49b7930_NEIKI.exe	29
PID 1636 wrote to memory of 1996	1636	cmd.exe	30
PID 1636 wrote to memory of 1996	1636	cmd.exe	30
PID 1636 wrote to memory of 1996	1636	cmd.exe	30
PID 1636 wrote to memory of 1996	1636	cmd.exe	30
PID 1996 wrote to memory of 1988	1996	[email protected]	31
PID 1996 wrote to memory of 1988	1996	[email protected]	31
PID 1996 wrote to memory of 1988	1996	[email protected]	31
PID 1996 wrote to memory of 1988	1996	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\9be92c18f41fd6033ef1ce78a49b7930_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\9be92c18f41fd6033ef1ce78a49b7930_NEIKI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:1988

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
368cfcaf34e4c019758626170bce8262

SHA1
6a1090195a23f1e8ab0dcb31717409fe46467ffd

SHA256
d0b7d486d59ad99c25fc61ab445ace0cc16e4a74b006785b927a6f3bd9a81978

SHA512
b1cf3eab1c9f780fa2bfb18821ee32c83470ba81881b3d764af5021b3ea873ba34df67de393f09eaebf1c6d2c8c2540f64d7276a78e10faf39168d1d5df31003

Download Submit
memory/1996-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2868-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download