941fc018c4f075e60d208e0949bda7f1ca9c2092b5d446a9792a0665c5ea4204

Analysis

max time kernel
140s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 22:42

Target

827f8493f39807def7549a4b31f5f590_NEIKI.dll
Size

294KB
MD5

827f8493f39807def7549a4b31f5f590
SHA1

11eaa9f1e434b25b4a5698768695f9db979a43a4
SHA256

941fc018c4f075e60d208e0949bda7f1ca9c2092b5d446a9792a0665c5ea4204
SHA512

8f6dad2e1dfe62b4f43eef8e8c94bc11a4a9b7ed4fcee1d8f3831aa9845b9a5b06040c5b02a0592a6d9fa5debc0248db158ab371f78e290a7604e5e688fb649f
SSDEEP

3072:KMkzUdd1SnCr/KivLYjTt09q95xJ2FaEzRbSgVBJ8tZYCmoJHihpU/fOIkXBJqqf:J8UT1SCzK7jZ09UfstlCFihpUHQq7Ot

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5188	4864	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5264 wrote to memory of 4864	5264	rundll32.exe	83
PID 5264 wrote to memory of 4864	5264	rundll32.exe	83
PID 5264 wrote to memory of 4864	5264	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\827f8493f39807def7549a4b31f5f590_NEIKI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\827f8493f39807def7549a4b31f5f590_NEIKI.dll,#1
  2⤵
  PID:4864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 648
    3⤵
    - Program crash
    PID:5188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4864 -ip 4864
1⤵
PID:4800

memory/4864-0-0x0000000075649000-0x000000007566C000-memory.dmp

Filesize
140KB

Download
memory/4864-1-0x0000000075649000-0x000000007566C000-memory.dmp

Filesize
140KB

Download