1bc68a21f6db9c2c3c0354e292267e318033f3da7be3b4b2903c1a5bce6c5bf9 | Triage

Analysis

max time kernel
132s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 00:28

Sharing

Report Analysis Logs

General

Target

7b7393e5dfc44e3dabf2486c09a95270_NEIKI.dll
Size

3KB
MD5

7b7393e5dfc44e3dabf2486c09a95270
SHA1

d293490a625d8ba8e9d20ffcc1d05ce1a519c11c
SHA256

1bc68a21f6db9c2c3c0354e292267e318033f3da7be3b4b2903c1a5bce6c5bf9
SHA512

f656399299e8a60fdb9d8ae5ae5441fc55fc9fc573699f3d017006478bb2ef628edecc081a6a5b7b1db6768558c4c953b6f277bd2d1f27c8cfd0c39c34452aff

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 2724	4200	rundll32.exe	84
PID 4200 wrote to memory of 2724	4200	rundll32.exe	84
PID 4200 wrote to memory of 2724	4200	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7b7393e5dfc44e3dabf2486c09a95270_NEIKI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7b7393e5dfc44e3dabf2486c09a95270_NEIKI.dll,#1
  2⤵
  PID:2724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads