67904921c2c2b8a741b5c278e407b8c051c5dda3b857a50bf4f11a1c7e8ae88b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 10:48

Target

6d6568fac7b40264833ecb4fd0ce4650_NEIKI.exe
Size

73KB
MD5

6d6568fac7b40264833ecb4fd0ce4650
SHA1

45d9cffb0f3bf7dad8587fdae6ed89a0b8939acc
SHA256

67904921c2c2b8a741b5c278e407b8c051c5dda3b857a50bf4f11a1c7e8ae88b
SHA512

77cd535b0ae01418f390dc530d324a18a0c407a3730b6d48c4128dbd092be26b59cb98c386b90701421d4c1fe088512fa9ab8222ff0dd8d1df85a2db0556fa11
SSDEEP

1536:hbdguCuiVJjn1ZK5QPqfhVWbdsmA+RjPFLC+e5hsd0ZGUGf2g:hinJjnXNPqfcxA+HFshsdOg

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
388	[email protected]

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1268	1892	6d6568fac7b40264833ecb4fd0ce4650_NEIKI.exe	84
PID 1892 wrote to memory of 1268	1892	6d6568fac7b40264833ecb4fd0ce4650_NEIKI.exe	84
PID 1892 wrote to memory of 1268	1892	6d6568fac7b40264833ecb4fd0ce4650_NEIKI.exe	84
PID 1268 wrote to memory of 388	1268	cmd.exe	85
PID 1268 wrote to memory of 388	1268	cmd.exe	85
PID 1268 wrote to memory of 388	1268	cmd.exe	85
PID 388 wrote to memory of 3520	388	[email protected]	86
PID 388 wrote to memory of 3520	388	[email protected]	86
PID 388 wrote to memory of 3520	388	[email protected]	86

C:\Users\Admin\AppData\Local\Temp\6d6568fac7b40264833ecb4fd0ce4650_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\6d6568fac7b40264833ecb4fd0ce4650_NEIKI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:388
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:3520

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
99700040a002c02b4f8536f66dea77a1

SHA1
011e55752914370712858d41b368d3399b969465

SHA256
4b4b139f68d23a2b55e5a041621ebbb9c9c593c79905ae8eed773297feb883fc

SHA512
b957858e45c7f26c117e83417a73c9a3e66a0fba8de736c75a42142f051433c3802af1605deeae6bcff66b98efd8ac82a7f6a74693340c422328e7cbc2b79cb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\00.exe

Filesize
2KB

MD5
7b621943a35e7f39cf89f50cc48d7b94

SHA1
2858a28cf60f38025fffcd0ba2ecfec8511c197d

SHA256
bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

SHA512
4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

Download Submit
memory/388-7-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1892-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download