06415c150c081b245e2223c260e20e6c8c0ee5b3f1d0121f62a7df061c186c4c

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 08:05

Target

1ee28b54da46ca7b6256400f26052d80_NEIKI.exe
Size

8.1MB
MD5

1ee28b54da46ca7b6256400f26052d80
SHA1

eac89deee04fc08f92be6f03b64cf6a1cf8cf8b0
SHA256

06415c150c081b245e2223c260e20e6c8c0ee5b3f1d0121f62a7df061c186c4c
SHA512

1b9788df972934b3c358f36cdc3903667be4829c809b1f5ee69a62d34a58fa03643311996f4a15ddd2b2963b1f1ccf6f18d3a08be8f8f70a07f2860bc4c08a10
SSDEEP

196608:7aCdva8ND9LctcpYryMRWTDxpBMrLixOeTsQrTKZG4s4I5gJ:7RdSQD9L6UDxHMrLsroGAI5w

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1504	1ee28b54da46ca7b6256400f26052d80_NEIKI.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 1504	4468	1ee28b54da46ca7b6256400f26052d80_NEIKI.exe	84
PID 4468 wrote to memory of 1504	4468	1ee28b54da46ca7b6256400f26052d80_NEIKI.exe	84
PID 4468 wrote to memory of 1504	4468	1ee28b54da46ca7b6256400f26052d80_NEIKI.exe	84

C:\Users\Admin\AppData\Local\Temp\1ee28b54da46ca7b6256400f26052d80_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\1ee28b54da46ca7b6256400f26052d80_NEIKI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Users\Admin\AppData\Local\Temp\is-31PLV.tmp\1ee28b54da46ca7b6256400f26052d80_NEIKI.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-31PLV.tmp\1ee28b54da46ca7b6256400f26052d80_NEIKI.tmp" /SL5="$501CE,8297165,54272,C:\Users\Admin\AppData\Local\Temp\1ee28b54da46ca7b6256400f26052d80_NEIKI.exe"
  2⤵
  - Executes dropped EXE
  PID:1504

C:\Users\Admin\AppData\Local\Temp\is-31PLV.tmp\1ee28b54da46ca7b6256400f26052d80_NEIKI.tmp

Filesize
688KB

MD5
c765336f0dcf4efdcc2101eed67cd30c

SHA1
fa0279f59738c5aa3b6b20106e109ccd77f895a7

SHA256
c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28

SHA512
06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

Download Submit
memory/1504-10-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/1504-14-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/4468-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4468-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/4468-13-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download