56e3cba3bb83c67f95d46aab32a7e4ce99d3c66eec3501e002b700e1306879f3 | Triage

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 13:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bea1fad6651332162f5eb0edf6e22620_NEIKI.dll
Size

6KB
MD5

bea1fad6651332162f5eb0edf6e22620
SHA1

92e5af20bec0150cf0afb2956e400a11452e1606
SHA256

56e3cba3bb83c67f95d46aab32a7e4ce99d3c66eec3501e002b700e1306879f3
SHA512

4c2444aba111bcc762be3295e4539de911d83f595f78d767aeac31f5d131aea533b8e0da1c86ed72a7ff6e8c7cba43691e261332a2dd0ce3a517a8e74aceb2d6
SSDEEP

48:6WQV5YVOqtV0H1pw9ygYVUG0qB+BDq9J5SC:8qtV0HAr4LB+FqX5SC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 5068	4244	rundll32.exe	83
PID 4244 wrote to memory of 5068	4244	rundll32.exe	83
PID 4244 wrote to memory of 5068	4244	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bea1fad6651332162f5eb0edf6e22620_NEIKI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bea1fad6651332162f5eb0edf6e22620_NEIKI.dll,#1
  2⤵
  PID:5068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads