ec19ce800fb5f36596790e34741e2d34d8b5b57f235a6d01ffc835542442d7c2

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 00:13

Target

754b3779c3749f8dbf8f0876210f1850_NEIKI.dll
Size

5KB
MD5

754b3779c3749f8dbf8f0876210f1850
SHA1

b6a0f5fd28d92be4257f7ab5219de65cdf3199bc
SHA256

ec19ce800fb5f36596790e34741e2d34d8b5b57f235a6d01ffc835542442d7c2
SHA512

a9f5f6a2f2b9067821ddc0c264c98c692872bb8adeab788520afa6aa8b576e1ad9a0ce40665f7cb2d5b3510d45918bf467af14de461808a0171d51431e9a85c4
SSDEEP

48:SfIBj0W6/aGxkaklS4rklStklSd8klSPklSTIZGifi5qwlGsPvw/dWvj98xpvjOv:DixZjmjtjd8jPjcZGR5TIML9OvIqDi

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 2368	5080	rundll32.exe	90
PID 5080 wrote to memory of 2368	5080	rundll32.exe	90
PID 5080 wrote to memory of 2368	5080	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\754b3779c3749f8dbf8f0876210f1850_NEIKI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\754b3779c3749f8dbf8f0876210f1850_NEIKI.dll,#1
  2⤵
  PID:2368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:2756