1bc68a21f6db9c2c3c0354e292267e318033f3da7be3b4b2903c1a5bce6c5bf9 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 00:28

Sharing

Report Analysis Logs

General

Target

7b7393e5dfc44e3dabf2486c09a95270_NEIKI.dll
Size

3KB
MD5

7b7393e5dfc44e3dabf2486c09a95270
SHA1

d293490a625d8ba8e9d20ffcc1d05ce1a519c11c
SHA256

1bc68a21f6db9c2c3c0354e292267e318033f3da7be3b4b2903c1a5bce6c5bf9
SHA512

f656399299e8a60fdb9d8ae5ae5441fc55fc9fc573699f3d017006478bb2ef628edecc081a6a5b7b1db6768558c4c953b6f277bd2d1f27c8cfd0c39c34452aff

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2252	2184	rundll32.exe	28
PID 2184 wrote to memory of 2252	2184	rundll32.exe	28
PID 2184 wrote to memory of 2252	2184	rundll32.exe	28
PID 2184 wrote to memory of 2252	2184	rundll32.exe	28
PID 2184 wrote to memory of 2252	2184	rundll32.exe	28
PID 2184 wrote to memory of 2252	2184	rundll32.exe	28
PID 2184 wrote to memory of 2252	2184	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7b7393e5dfc44e3dabf2486c09a95270_NEIKI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7b7393e5dfc44e3dabf2486c09a95270_NEIKI.dll,#1
  2⤵
  PID:2252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads