941fc018c4f075e60d208e0949bda7f1ca9c2092b5d446a9792a0665c5ea4204

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 22:42

Target

827f8493f39807def7549a4b31f5f590_NEIKI.dll
Size

294KB
MD5

827f8493f39807def7549a4b31f5f590
SHA1

11eaa9f1e434b25b4a5698768695f9db979a43a4
SHA256

941fc018c4f075e60d208e0949bda7f1ca9c2092b5d446a9792a0665c5ea4204
SHA512

8f6dad2e1dfe62b4f43eef8e8c94bc11a4a9b7ed4fcee1d8f3831aa9845b9a5b06040c5b02a0592a6d9fa5debc0248db158ab371f78e290a7604e5e688fb649f
SSDEEP

3072:KMkzUdd1SnCr/KivLYjTt09q95xJ2FaEzRbSgVBJ8tZYCmoJHihpU/fOIkXBJqqf:J8UT1SCzK7jZ09UfstlCFihpUHQq7Ot

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2408	2128	rundll32.exe	28
PID 2128 wrote to memory of 2408	2128	rundll32.exe	28
PID 2128 wrote to memory of 2408	2128	rundll32.exe	28
PID 2128 wrote to memory of 2408	2128	rundll32.exe	28
PID 2128 wrote to memory of 2408	2128	rundll32.exe	28
PID 2128 wrote to memory of 2408	2128	rundll32.exe	28
PID 2128 wrote to memory of 2408	2128	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\827f8493f39807def7549a4b31f5f590_NEIKI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\827f8493f39807def7549a4b31f5f590_NEIKI.dll,#1
  2⤵
  PID:2408

memory/2408-0-0x0000000075429000-0x000000007544C000-memory.dmp

Filesize
140KB

Download