f2911cd860fade351a8ad0621f0c62b39f77fdba64a3a0e49451de32cf396405

Analysis

max time kernel
145s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 22:19

Target
4e4d534a25c32ce72a7b23e3cd839880_NEIKI.dll
Size 1.7MB
Sample240507-18gp5adf62
SHA256 f2911cd860fade351a8ad0621f0c62b39f77fdba64a3a0e49451de32cf396405
MD5 4e4d534a25c32ce72a7b23e3cd839880
SHA1 8251ebd5cd4e9ffbd45fe747faae787ca0ec1b9d
SHA512 a6ae2dd00a3cbc68abccc8a6417450de8f0a180c29f0df5d4f597088fe38dcd7d561b1a7ed04f81e4f871b079e08bc8ca344381e2252897b18d550b6091efc36
SSDEEP 24576:TwqKPGAaCgIw6c4ciph64vSMDighMKM5rSjLmwEMtRGwmof6tTn2jEx5M1K0Y:TAncqcTnJ5R
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1292	1536	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 1536	1540	rundll32.exe	83
PID 1540 wrote to memory of 1536	1540	rundll32.exe	83
PID 1540 wrote to memory of 1536	1540	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e4d534a25c32ce72a7b23e3cd839880_NEIKI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e4d534a25c32ce72a7b23e3cd839880_NEIKI.dll,#1
  2⤵
  PID:1536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 636
    3⤵
    - Program crash
    PID:1292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1536 -ip 1536
1⤵
PID:612