6152111d78c30935a2bbf224ade4f0d7baa3770b5ede95457b9a60fb5043023c

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 00:16

Target

76976f20c1273f119eea64a64f30bea0_NEIKI.dll
Size

5KB
MD5

76976f20c1273f119eea64a64f30bea0
SHA1

7aab6a3162386124bcdd2b5c1b49b3a6d90795ad
SHA256

6152111d78c30935a2bbf224ade4f0d7baa3770b5ede95457b9a60fb5043023c
SHA512

0db51de2bca931fb6ca637c511041216138fd0dba3c7f54703607ee7665e4b77e72a7b073d72d2a478592d8933228f30a229037a686e54a1b18a310dd41e1913
SSDEEP

96:DixZjmjtjd8jPjcZGR5TIJ4UssyicopLFFD0o+ub6zf6+vp8VjP1:unSR6bgYZdicojW1LBqVjP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1984	1992	rundll32.exe	28
PID 1992 wrote to memory of 1984	1992	rundll32.exe	28
PID 1992 wrote to memory of 1984	1992	rundll32.exe	28
PID 1992 wrote to memory of 1984	1992	rundll32.exe	28
PID 1992 wrote to memory of 1984	1992	rundll32.exe	28
PID 1992 wrote to memory of 1984	1992	rundll32.exe	28
PID 1992 wrote to memory of 1984	1992	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\76976f20c1273f119eea64a64f30bea0_NEIKI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\76976f20c1273f119eea64a64f30bea0_NEIKI.dll,#1
  2⤵
  PID:1984