471e56201a25f0dcbfebbdc5d46f96fd41782baad7894f6495ee96eac154b15f

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 13:26

Target

NeutrinoInjector.exe
Size

286KB
MD5

a6cbdec2df3f1170d9c1ce64246d7862
SHA1

0507fa82022032a939def136439ac2e823807886
SHA256

471e56201a25f0dcbfebbdc5d46f96fd41782baad7894f6495ee96eac154b15f
SHA512

5b4d821a1c19f0cbb19922bcd18b959b29aee44e659cd7395ecb78d689957bcab1bcac36e13baf78287a382862466812c99b626b79fd97b581c59b4378a152c8
SSDEEP

6144:JYMMF6xkq3SaS2HqCs1ZFU99y2DvrZORnv73/jmmuxUpgSDPfu:JYNE2q3nQq9tknvj/jmbxUpgSrfu

Score

1^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 2224	868	NeutrinoInjector.exe	29
PID 868 wrote to memory of 2224	868	NeutrinoInjector.exe	29
PID 868 wrote to memory of 2224	868	NeutrinoInjector.exe	29
PID 868 wrote to memory of 2224	868	NeutrinoInjector.exe	29

C:\Users\Admin\AppData\Local\Temp\NeutrinoInjector.exe
"C:\Users\Admin\AppData\Local\Temp\NeutrinoInjector.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c color 5F
  2⤵
  PID:2224