447834759c0497634a3380c6b0c4e404e16be7b6a0c51b336726c019b44db061

Analysis

max time kernel
140s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 01:09

Target

8a07227b92e81b5d2faaa3610b9d0c20_NEIKI.dll
Size

59KB
MD5

8a07227b92e81b5d2faaa3610b9d0c20
SHA1

a365b7f41b98ac60b7c26a3017c07e2ff7eb5816
SHA256

447834759c0497634a3380c6b0c4e404e16be7b6a0c51b336726c019b44db061
SHA512

9600962e860298a23d4070a3f140fe6e8a7632ebd8ee8ad6a364caa83dec566064d0a1525a687067a71bd813182ef1be52e21c5e54accdf3532c712efe2e4276
SSDEEP

1536:ob8Vwn/MK4CLMM5SCmZWIoJqZapLy3EAxCEaHh3:oz/VfLHWJZOLy35QRh3

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1560-0-0x0000000010000000-0x000000001000D000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1560	1500	rundll32.exe	85
PID 1500 wrote to memory of 1560	1500	rundll32.exe	85
PID 1500 wrote to memory of 1560	1500	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a07227b92e81b5d2faaa3610b9d0c20_NEIKI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a07227b92e81b5d2faaa3610b9d0c20_NEIKI.dll,#1
  2⤵
  PID:1560

memory/1560-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download