c6f0a7b0926829f061602a638771f801bce4fd50650956f3f672b989a09ae8ba

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 13:48

Target

cb583d73eaa08835bd77866dc74d8ca0_NEIKI.dll
Size

124KB
MD5

cb583d73eaa08835bd77866dc74d8ca0
SHA1

e70ac8b93b205cddee25a56f7352597a6170afe3
SHA256

c6f0a7b0926829f061602a638771f801bce4fd50650956f3f672b989a09ae8ba
SHA512

09a809190af0ff4c541ae5993b3bd0ea20b8372f6fb3538d91ba820b1981bf3c3023ef9d8d47d820b797dcfd6343c20f6bb36ecda9e09829bb09349abf89fef3
SSDEEP

1536:rh0LeVj+beWECtcuZHA95Z+KJ2wx84l97jHRGWaz053NWksFHPPPPPHeV63ZVc/q:reLeUbywcmSf+Kpx8yXH3NWkdL7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 2200	1784	rundll32.exe	28
PID 1784 wrote to memory of 2200	1784	rundll32.exe	28
PID 1784 wrote to memory of 2200	1784	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb583d73eaa08835bd77866dc74d8ca0_NEIKI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1784 -s 80
  2⤵
  PID:2200