920c021801646daefdb66ef82d124b3545363597f744edc036fa7f589ef8a3aa

Analysis

max time kernel
134s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 12:05

Target
a0fe40d337bc037a741eaef84d193440_NEIKI.exe
Size 781KB
Sample240508-n9hycsbf4y
SHA256 920c021801646daefdb66ef82d124b3545363597f744edc036fa7f589ef8a3aa
MD5 a0fe40d337bc037a741eaef84d193440
SHA1 ec98fd89c6d97ec48074d29fd6591e9fc506e7f9
SHA512 1398fb8e9c600e9344d86d1a24ce44232d68f60d08f1338923b1e26d635907b3da3321c3fe02ae07f44de45712bd50e776b0db29cec7e2dcb318c25302499d50
SSDEEP 12288:tT+WNwgW1Q7tRGq4qwBD9ANiZVD14KiBI4njSgRAeKJLZmG19anY:tTEgcGazRD9ANiDD1henHkLZmG19anY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2700	638C.tmp

Executes dropped EXE 1 IoCs

pid	Process
2700	638C.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 2700	4988	a0fe40d337bc037a741eaef84d193440_NEIKI.exe	84
PID 4988 wrote to memory of 2700	4988	a0fe40d337bc037a741eaef84d193440_NEIKI.exe	84
PID 4988 wrote to memory of 2700	4988	a0fe40d337bc037a741eaef84d193440_NEIKI.exe	84

C:\Users\Admin\AppData\Local\Temp\a0fe40d337bc037a741eaef84d193440_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\a0fe40d337bc037a741eaef84d193440_NEIKI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Users\Admin\AppData\Local\Temp\638C.tmp
  "C:\Users\Admin\AppData\Local\Temp\638C.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2700

638C.tmp

Path C:\Users\Admin\AppData\Local\Temp\638C.tmp
Size 781KB
SHA256 5e19b43e58fde5bd862c1343a4e1d5b07798bf6afbf896a44fb236dbbc26165c
MD5 8cb29b8d6204f1b954c5b5114808cb1d
SHA1 f6aebf92ebef11782e7394a9b47a8f34d02c41ff
SHA512 e6f0aae07df04906e64b3ddd5ce3fb1386e202518a125c42a4d98654fc361a17b699a7f3242e5c256cb20da9c6d677a344947b3dc006e540aa7244f2bae342c1
SSDEEP 12288:tT+WNwpNkBE1IKnKlpdFEjJz/fKUwYKJLZmG19anY:tTEpAEaKKlEjlKxLZmG19anY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2700-6-0x0000000000470000-0x0000000000530000-memory.dmp

Download

memory/2700-7-0x0000000000470000-0x0000000000530000-memory.dmp

Download

memory/4988-0-0x0000000000C00000-0x0000000000CC0000-memory.dmp

Download

memory/4988-4-0x0000000000C00000-0x0000000000CC0000-memory.dmp

Download