2fbd5855cd139711a4d1a7d7514c189d446201f0c5a6cd4f2a5efbe30eb84a7a | Triage

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 22:52

Sharing

Report Analysis Logs

General

Target

87a6b83edcd21aada024742f33ef47e0_NEIKI.dll
Size

192KB
MD5

87a6b83edcd21aada024742f33ef47e0
SHA1

1aafbb8f357abb31146a34f7ff95cfe6d1e3e5cb
SHA256

2fbd5855cd139711a4d1a7d7514c189d446201f0c5a6cd4f2a5efbe30eb84a7a
SHA512

8bd8f8bfbb766e22f1134a3e69c299c23938189183621cfdda0e3d35a7231fe2ae9cbbaab7af0fcfd70097af11d7a3b0bb02528ed15184fb3d2355c65763a5f8
SSDEEP

3072:480J8IMILmCa3yx6oFEdgVXnFtNmRggfxm3:4okmCaiEoFEd+FHYxm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2180	2072	rundll32.exe	28
PID 2072 wrote to memory of 2180	2072	rundll32.exe	28
PID 2072 wrote to memory of 2180	2072	rundll32.exe	28
PID 2072 wrote to memory of 2180	2072	rundll32.exe	28
PID 2072 wrote to memory of 2180	2072	rundll32.exe	28
PID 2072 wrote to memory of 2180	2072	rundll32.exe	28
PID 2072 wrote to memory of 2180	2072	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\87a6b83edcd21aada024742f33ef47e0_NEIKI.dll,#1
  2⤵
  PID:2180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads