742bbd34667c153af56bf1cb9d402373862b6eed327d3316b30489715e960874

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 03:49

Target

c265c4261d0b99ed170492244f6dd100_NEIKI.exe
Size

79KB
MD5

c265c4261d0b99ed170492244f6dd100
SHA1

b95761e0716431cb1c9da4006bb0cc8dd4056e88
SHA256

742bbd34667c153af56bf1cb9d402373862b6eed327d3316b30489715e960874
SHA512

8f16fa8a6e04bb9c529a3ba97826075657de0732a68b2170f2fb47d9490dababa225b2746fe69451265664f1918c1363503b4c521d826850eaffe443b9915dad
SSDEEP

1536:zvm5Om0rld8Ms1FAOgSmOQA8AkqUhMb2nuy5wgIP0CSJ+5yYB8GMGlZ5G:zvm5OTld8r1QSjGdqU7uy5w9WMyYN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3020	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
2552	cmd.exe
2552	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2552	2028	c265c4261d0b99ed170492244f6dd100_NEIKI.exe	29
PID 2028 wrote to memory of 2552	2028	c265c4261d0b99ed170492244f6dd100_NEIKI.exe	29
PID 2028 wrote to memory of 2552	2028	c265c4261d0b99ed170492244f6dd100_NEIKI.exe	29
PID 2028 wrote to memory of 2552	2028	c265c4261d0b99ed170492244f6dd100_NEIKI.exe	29
PID 2552 wrote to memory of 3020	2552	cmd.exe	30
PID 2552 wrote to memory of 3020	2552	cmd.exe	30
PID 2552 wrote to memory of 3020	2552	cmd.exe	30
PID 2552 wrote to memory of 3020	2552	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\c265c4261d0b99ed170492244f6dd100_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\c265c4261d0b99ed170492244f6dd100_NEIKI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:3020

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
650b9aa994af79cdde5798b77427075f

SHA1
9c4aa5b0e12d298933ffed1f7ff3c8d0c30430a9

SHA256
64c8866ec5891d3cef40da40ff11099f7feef5712a91e28e402356097d70b0ab

SHA512
a23316201c8d2915bd9fbc38681bd2cd684c1f96ed090d6f3039d180734133cb0380a9ce85581a3d0cfd25418bf44355833ccc592602cfc35e2be7628201125b

Download Submit
memory/2028-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3020-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download