742bbd34667c153af56bf1cb9d402373862b6eed327d3316b30489715e960874

Analysis

max time kernel
136s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 03:49

Target
c265c4261d0b99ed170492244f6dd100_NEIKI.exe
Size 79KB
Sample240508-edkyeabg48
SHA256 742bbd34667c153af56bf1cb9d402373862b6eed327d3316b30489715e960874
MD5 c265c4261d0b99ed170492244f6dd100
SHA1 b95761e0716431cb1c9da4006bb0cc8dd4056e88
SHA512 8f16fa8a6e04bb9c529a3ba97826075657de0732a68b2170f2fb47d9490dababa225b2746fe69451265664f1918c1363503b4c521d826850eaffe443b9915dad
SSDEEP 1536:zvm5Om0rld8Ms1FAOgSmOQA8AkqUhMb2nuy5wgIP0CSJ+5yYB8GMGlZ5G:zvm5OTld8r1QSjGdqU7uy5w9WMyYN5G
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4448	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 4748	1696	c265c4261d0b99ed170492244f6dd100_NEIKI.exe	86
PID 1696 wrote to memory of 4748	1696	c265c4261d0b99ed170492244f6dd100_NEIKI.exe	86
PID 1696 wrote to memory of 4748	1696	c265c4261d0b99ed170492244f6dd100_NEIKI.exe	86
PID 4748 wrote to memory of 4448	4748	cmd.exe	87
PID 4748 wrote to memory of 4448	4748	cmd.exe	87
PID 4748 wrote to memory of 4448	4748	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\c265c4261d0b99ed170492244f6dd100_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\c265c4261d0b99ed170492244f6dd100_NEIKI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:4448

Path C:\Users\Admin\AppData\Local\Temp\[email protected]
Size 79KB
SHA256 64c8866ec5891d3cef40da40ff11099f7feef5712a91e28e402356097d70b0ab
MD5 650b9aa994af79cdde5798b77427075f
SHA1 9c4aa5b0e12d298933ffed1f7ff3c8d0c30430a9
SHA512 a23316201c8d2915bd9fbc38681bd2cd684c1f96ed090d6f3039d180734133cb0380a9ce85581a3d0cfd25418bf44355833ccc592602cfc35e2be7628201125b
SSDEEP 1536:zv+vF0ocOQA8AkqUhMb2nuy5wgIP0CSJ+5yoB8GMGlZ5G:zv+vTpGdqU7uy5w9WMyoN5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1696-6-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4448-5-0x0000000000400000-0x000000000041B000-memory.dmp

Download