db133cae81d8a53bd2880cadc009c6e40ccad82cefe3245d019f9b1506fcb347

Analysis

max time kernel
139s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 20:52

Target

2f00ef8dfe2cf9d995e9240cd777ba30_NEIKI.dll
Size

81KB
MD5

2f00ef8dfe2cf9d995e9240cd777ba30
SHA1

e7032c6340364a137953757fc845953afcc9ff53
SHA256

db133cae81d8a53bd2880cadc009c6e40ccad82cefe3245d019f9b1506fcb347
SHA512

9be61cfdac2585ecdfab91d21fabedd2ac3f3d209cfbc7312c12862cbbcbae4702b25dfab1711c476065e6b3786c2f14f180b7ba4c97f5f796e343d51e8fc51b
SSDEEP

1536:FByXv7uWGEqXZKXTadSp7Lxw9zzBPw+NASUSFOj8sWHcdF6+eXq8WB:Av4JKXTx71wnArSsXFpeXq8WB

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 4380	2992	rundll32.exe	90
PID 2992 wrote to memory of 4380	2992	rundll32.exe	90
PID 2992 wrote to memory of 4380	2992	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f00ef8dfe2cf9d995e9240cd777ba30_NEIKI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f00ef8dfe2cf9d995e9240cd777ba30_NEIKI.dll,#1
  2⤵
  PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:3096