45dd3fe1e539deb67d4a566f2c8294720478cc8b72b96d7d35a1d6b87751df89

Analysis

max time kernel
93s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 00:01

Target

a577a44aa9c7220ae83935218d2e9990_NEIKI.dll
Size

337KB
MD5

a577a44aa9c7220ae83935218d2e9990
SHA1

1a95fdd3048e753a7ef8752df66574072972ba68
SHA256

45dd3fe1e539deb67d4a566f2c8294720478cc8b72b96d7d35a1d6b87751df89
SHA512

2a01f589ba2948e960d31ca41aed5e59529fe34aef5d17621eb769a7843dede93d3b7e95c7c679b5180184897e1f076f326dcd9456c55b38bd54815bb687c41a
SSDEEP

6144:cB8cYmOfX6q+3aSfq9qpzysnbFxz6S7fK33eFpCUwp5Fx5hTjeziOCK++ZSiiAMg:c/YmI6Namq9qpzyKbFP7KHMCXTeziOa

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 820	1948	rundll32.exe	80
PID 1948 wrote to memory of 820	1948	rundll32.exe	80
PID 1948 wrote to memory of 820	1948	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a577a44aa9c7220ae83935218d2e9990_NEIKI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a577a44aa9c7220ae83935218d2e9990_NEIKI.dll,#1
  2⤵
  PID:820