67904921c2c2b8a741b5c278e407b8c051c5dda3b857a50bf4f11a1c7e8ae88b

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 10:48

Target

6d6568fac7b40264833ecb4fd0ce4650_NEIKI.exe
Size

73KB
MD5

6d6568fac7b40264833ecb4fd0ce4650
SHA1

45d9cffb0f3bf7dad8587fdae6ed89a0b8939acc
SHA256

67904921c2c2b8a741b5c278e407b8c051c5dda3b857a50bf4f11a1c7e8ae88b
SHA512

77cd535b0ae01418f390dc530d324a18a0c407a3730b6d48c4128dbd092be26b59cb98c386b90701421d4c1fe088512fa9ab8222ff0dd8d1df85a2db0556fa11
SSDEEP

1536:hbdguCuiVJjn1ZK5QPqfhVWbdsmA+RjPFLC+e5hsd0ZGUGf2g:hinJjnXNPqfcxA+HFshsdOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2832	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
1880	cmd.exe
1880	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1880	2196	6d6568fac7b40264833ecb4fd0ce4650_NEIKI.exe	29
PID 2196 wrote to memory of 1880	2196	6d6568fac7b40264833ecb4fd0ce4650_NEIKI.exe	29
PID 2196 wrote to memory of 1880	2196	6d6568fac7b40264833ecb4fd0ce4650_NEIKI.exe	29
PID 2196 wrote to memory of 1880	2196	6d6568fac7b40264833ecb4fd0ce4650_NEIKI.exe	29
PID 1880 wrote to memory of 2832	1880	cmd.exe	30
PID 1880 wrote to memory of 2832	1880	cmd.exe	30
PID 1880 wrote to memory of 2832	1880	cmd.exe	30
PID 1880 wrote to memory of 2832	1880	cmd.exe	30
PID 2832 wrote to memory of 2932	2832	[email protected]	31
PID 2832 wrote to memory of 2932	2832	[email protected]	31
PID 2832 wrote to memory of 2932	2832	[email protected]	31
PID 2832 wrote to memory of 2932	2832	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\6d6568fac7b40264833ecb4fd0ce4650_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\6d6568fac7b40264833ecb4fd0ce4650_NEIKI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 15225.exe
      4⤵
      PID:2932

\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
99700040a002c02b4f8536f66dea77a1

SHA1
011e55752914370712858d41b368d3399b969465

SHA256
4b4b139f68d23a2b55e5a041621ebbb9c9c593c79905ae8eed773297feb883fc

SHA512
b957858e45c7f26c117e83417a73c9a3e66a0fba8de736c75a42142f051433c3802af1605deeae6bcff66b98efd8ac82a7f6a74693340c422328e7cbc2b79cb9

Download Submit
memory/2196-11-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2832-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download