2d0dd3e0bd04adc7657744f799a7ec8e7ee1f8370d9b6c0037fe1190b4751251

Analysis

max time kernel
136s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 21:48

Target

42dd56793c8c17f612f226f05f2ab910_NEIKI.dll
Size

2.8MB
MD5

42dd56793c8c17f612f226f05f2ab910
SHA1

3882bd7f004989dcd853faa9b06e75abb5229944
SHA256

2d0dd3e0bd04adc7657744f799a7ec8e7ee1f8370d9b6c0037fe1190b4751251
SHA512

271ce31bf5cb749e82055556da44791b01565a8f899ec7224eca44ef51868eaacaad0e635fffdbbfbba26f5ac49c7e8c2fa46404384485e8c79e06d97b2278d5
SSDEEP

49152:csQKZsq9tqGpJS8XqOAWRUYxZa3iqExYVwms+GGnDa3o9:csQm9tqGpMmqOX2eZLTmJDa

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 2060	3780	rundll32.exe	82
PID 3780 wrote to memory of 2060	3780	rundll32.exe	82
PID 3780 wrote to memory of 2060	3780	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\42dd56793c8c17f612f226f05f2ab910_NEIKI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\42dd56793c8c17f612f226f05f2ab910_NEIKI.dll,#1
  2⤵
  PID:2060

memory/2060-1-0x0000000010000000-0x00000000102C1000-memory.dmp

Filesize
2.8MB

Download
memory/2060-0-0x00000000012C0000-0x00000000012C6000-memory.dmp

Filesize
24KB

Download
memory/2060-3-0x0000000003030000-0x0000000003158000-memory.dmp

Filesize
1.2MB

Download
memory/2060-7-0x0000000003160000-0x000000000326B000-memory.dmp

Filesize
1.0MB

Download
memory/2060-4-0x0000000003160000-0x000000000326B000-memory.dmp

Filesize
1.0MB

Download
memory/2060-8-0x0000000010000000-0x00000000102C1000-memory.dmp

Filesize
2.8MB

Download
memory/2060-14-0x0000000003160000-0x000000000326B000-memory.dmp

Filesize
1.0MB

Download
memory/2060-15-0x0000000003270000-0x00000000043B2000-memory.dmp

Filesize
17.3MB

Download
memory/2060-16-0x0000000002BB0000-0x0000000002CAF000-memory.dmp

Filesize
1020KB

Download
memory/2060-17-0x00000000043C0000-0x00000000044CE000-memory.dmp

Filesize
1.1MB

Download
memory/2060-19-0x00000000043C0000-0x00000000044CE000-memory.dmp

Filesize
1.1MB

Download
memory/2060-20-0x00000000043C0000-0x00000000044CE000-memory.dmp

Filesize
1.1MB

Download
memory/2060-21-0x0000000001040000-0x0000000001042000-memory.dmp

Filesize
8KB

Download
memory/2060-22-0x00000000300F0000-0x00000000300F4000-memory.dmp

Filesize
16KB

Download