aa12a4115a8be8bf7fc6843e437ecce46155af93ef656f1370704b27c7f87ad8

Analysis

max time kernel
138s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 01:00

Target

861b951119928b8134a4f449a4e4c3d0_NEIKI.exe
Size

160KB
MD5

861b951119928b8134a4f449a4e4c3d0
SHA1

cd3ec3e6ef3041b879f095148ff0a61bdb42efa4
SHA256

aa12a4115a8be8bf7fc6843e437ecce46155af93ef656f1370704b27c7f87ad8
SHA512

bf9ac4699b4eb7ea95dbeeb1ee0c3ab2fb78a5f55689457598d83521a05113dc11dd0dfa3c235dbcfa7061c5e0744a94eba49ca5675efa73e777c537d4179709
SSDEEP

1536:UH1kPkZccmK9OM1q6wYV6nBRiOW+bUciXDyeAvX0J7M6QG9wIa82U6q:YAM3ERioem9G9wlxu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4624	2752	WerFault.exe	87

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2752	winver.exe
2752	winver.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2752	winver.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3460	Explorer.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 2752	1204	861b951119928b8134a4f449a4e4c3d0_NEIKI.exe	87
PID 1204 wrote to memory of 2752	1204	861b951119928b8134a4f449a4e4c3d0_NEIKI.exe	87
PID 1204 wrote to memory of 2752	1204	861b951119928b8134a4f449a4e4c3d0_NEIKI.exe	87
PID 1204 wrote to memory of 2752	1204	861b951119928b8134a4f449a4e4c3d0_NEIKI.exe	87
PID 2752 wrote to memory of 3460	2752	winver.exe	56
PID 2752 wrote to memory of 2940	2752	winver.exe	49

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2752 -ip 2752
1⤵
PID:844

memory/1204-0-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1204-1-0x0000000000410000-0x0000000000413000-memory.dmp

Filesize
12KB

Download
memory/1204-2-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1204-4-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1204-3-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1204-12-0x0000000000400000-0x0000000000404A00-memory.dmp

Filesize
18KB

Download
memory/2752-9-0x0000000077C42000-0x0000000077C43000-memory.dmp

Filesize
4KB

Download
memory/2752-6-0x00000000012D0000-0x00000000012D7000-memory.dmp

Filesize
28KB

Download
memory/2752-17-0x00000000012D0000-0x00000000012D7000-memory.dmp

Filesize
28KB

Download
memory/2940-13-0x0000000000430000-0x0000000000437000-memory.dmp

Filesize
28KB

Download
memory/2940-14-0x0000000000430000-0x0000000000437000-memory.dmp

Filesize
28KB

Download
memory/3460-5-0x0000000000AD0000-0x0000000000AD7000-memory.dmp

Filesize
28KB

Download
memory/3460-10-0x00007FFFCE40D000-0x00007FFFCE40E000-memory.dmp

Filesize
4KB

Download
memory/3460-8-0x0000000000AD0000-0x0000000000AD7000-memory.dmp

Filesize
28KB

Download