ec19ce800fb5f36596790e34741e2d34d8b5b57f235a6d01ffc835542442d7c2

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 00:13

Target

754b3779c3749f8dbf8f0876210f1850_NEIKI.dll
Size

5KB
MD5

754b3779c3749f8dbf8f0876210f1850
SHA1

b6a0f5fd28d92be4257f7ab5219de65cdf3199bc
SHA256

ec19ce800fb5f36596790e34741e2d34d8b5b57f235a6d01ffc835542442d7c2
SHA512

a9f5f6a2f2b9067821ddc0c264c98c692872bb8adeab788520afa6aa8b576e1ad9a0ce40665f7cb2d5b3510d45918bf467af14de461808a0171d51431e9a85c4
SSDEEP

48:SfIBj0W6/aGxkaklS4rklStklSd8klSPklSTIZGifi5qwlGsPvw/dWvj98xpvjOv:DixZjmjtjd8jPjcZGR5TIML9OvIqDi

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2872	2856	rundll32.exe	28
PID 2856 wrote to memory of 2872	2856	rundll32.exe	28
PID 2856 wrote to memory of 2872	2856	rundll32.exe	28
PID 2856 wrote to memory of 2872	2856	rundll32.exe	28
PID 2856 wrote to memory of 2872	2856	rundll32.exe	28
PID 2856 wrote to memory of 2872	2856	rundll32.exe	28
PID 2856 wrote to memory of 2872	2856	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\754b3779c3749f8dbf8f0876210f1850_NEIKI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\754b3779c3749f8dbf8f0876210f1850_NEIKI.dll,#1
  2⤵
  PID:2872