53e1e89a8f10d7cd2d0495046eb4418b0139162da6699578a9b6700c03574675

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 19:56

Target

2ee660abf862896778c38c4fdbf20530_NEIKI.dll
Size

6KB
MD5

2ee660abf862896778c38c4fdbf20530
SHA1

45b0ed53886245088c7460ce3f942dccdb4f8eb9
SHA256

53e1e89a8f10d7cd2d0495046eb4418b0139162da6699578a9b6700c03574675
SHA512

debdc3480d7715c8c8e95d87002ec076597a16ebb3dd1acf8d7bf754a3f42c605a2cae87548326fdfda309390fe6cf03fd80e349e5cc3e2c55cb97442d5f207e
SSDEEP

96:hy859x0P8MaLjOp84OplG32E72HZhc08jreVbZ8M:F5oLsjOp8BSS5hc5eVbZ8M

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1440	1704	rundll32.exe	28
PID 1704 wrote to memory of 1440	1704	rundll32.exe	28
PID 1704 wrote to memory of 1440	1704	rundll32.exe	28
PID 1704 wrote to memory of 1440	1704	rundll32.exe	28
PID 1704 wrote to memory of 1440	1704	rundll32.exe	28
PID 1704 wrote to memory of 1440	1704	rundll32.exe	28
PID 1704 wrote to memory of 1440	1704	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ee660abf862896778c38c4fdbf20530_NEIKI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ee660abf862896778c38c4fdbf20530_NEIKI.dll,#1
  2⤵
  PID:1440