dd20ab603ad9fe9d0d468d40b08b338dac3a3c37a9f2bed1e85558f97abbd450

Analysis

max time kernel
132s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 01:51

Target

9be92c18f41fd6033ef1ce78a49b7930_NEIKI.exe
Size

73KB
MD5

9be92c18f41fd6033ef1ce78a49b7930
SHA1

3a6f1458d930dc5c53a7c4fbfb1d3c8fb9a6bded
SHA256

dd20ab603ad9fe9d0d468d40b08b338dac3a3c37a9f2bed1e85558f97abbd450
SHA512

6b4522814d7b3b668734b5acd597ea6b94e4fffc27afb92766e34665db2f39471a585e145af863b5f62003c56fc6aea343dbcb8cca960697596c5b34ceff042c
SSDEEP

1536:hbokyO8MUh6K5QPqfhVWbdsmA+RjPFLC+e5hPy0ZGUGf2g:hcrO7Uh6NPqfcxA+HFshKOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3436	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 856	836	9be92c18f41fd6033ef1ce78a49b7930_NEIKI.exe	84
PID 836 wrote to memory of 856	836	9be92c18f41fd6033ef1ce78a49b7930_NEIKI.exe	84
PID 836 wrote to memory of 856	836	9be92c18f41fd6033ef1ce78a49b7930_NEIKI.exe	84
PID 856 wrote to memory of 3436	856	cmd.exe	85
PID 856 wrote to memory of 3436	856	cmd.exe	85
PID 856 wrote to memory of 3436	856	cmd.exe	85
PID 3436 wrote to memory of 908	3436	[email protected]	86
PID 3436 wrote to memory of 908	3436	[email protected]	86
PID 3436 wrote to memory of 908	3436	[email protected]	86

C:\Users\Admin\AppData\Local\Temp\9be92c18f41fd6033ef1ce78a49b7930_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\9be92c18f41fd6033ef1ce78a49b7930_NEIKI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3436
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:908

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
368cfcaf34e4c019758626170bce8262

SHA1
6a1090195a23f1e8ab0dcb31717409fe46467ffd

SHA256
d0b7d486d59ad99c25fc61ab445ace0cc16e4a74b006785b927a6f3bd9a81978

SHA512
b1cf3eab1c9f780fa2bfb18821ee32c83470ba81881b3d764af5021b3ea873ba34df67de393f09eaebf1c6d2c8c2540f64d7276a78e10faf39168d1d5df31003

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/836-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3436-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download