ed228b05d64677b1192532bb52390121a5935c9876b263938a362f7a7ac01862

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 10:27

Target

63216c37d7154d5a988395983c98db10_NEIKI.dll
Size

465KB
MD5

63216c37d7154d5a988395983c98db10
SHA1

ee20378ce5a2cdc5788c0982b1d52cd2dd99eca7
SHA256

ed228b05d64677b1192532bb52390121a5935c9876b263938a362f7a7ac01862
SHA512

de4bb830e44bfc9839525e9b989911b3fa5f79a24d8ecbb0f46c867397ecdc3f675bbdd11b9ca197c0df7357580103fb9791e9a42d4bc860424cb636431982ba
SSDEEP

12288:fbRp5mjZfyOzHntxtywp5xQhd1/SQT5TUa7:JmjRyOzHnL5xQhd16QT5P

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2100	1964	rundll32.exe	28
PID 1964 wrote to memory of 2100	1964	rundll32.exe	28
PID 1964 wrote to memory of 2100	1964	rundll32.exe	28
PID 1964 wrote to memory of 2100	1964	rundll32.exe	28
PID 1964 wrote to memory of 2100	1964	rundll32.exe	28
PID 1964 wrote to memory of 2100	1964	rundll32.exe	28
PID 1964 wrote to memory of 2100	1964	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\63216c37d7154d5a988395983c98db10_NEIKI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\63216c37d7154d5a988395983c98db10_NEIKI.dll,#1
  2⤵
  PID:2100

memory/2100-0-0x0000000000240000-0x00000000002BA000-memory.dmp

Filesize
488KB

Download
memory/2100-1-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download