2ed21dbcfcbdba2f84ab0dde5abb8b9c6ac0a636c0286f011980b29d1667942e

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 09:26

Target

099bdc64230165448a9f291df9136eb0_NEIKI.dll
Size

6KB
MD5

099bdc64230165448a9f291df9136eb0
SHA1

1c3fbdd242d1575899b6490595775e75e6140217
SHA256

2ed21dbcfcbdba2f84ab0dde5abb8b9c6ac0a636c0286f011980b29d1667942e
SHA512

be648062dc517a97eba28cfaeab433da944fbe1f7eae27b3e88fc5edae04ad3ab35905815e3cae3c41552fc888f1c827f855518e278fcf78e6523cc3dd6c0857
SSDEEP

48:6EQt5YVOSVVEPy+wEMmqiHNpU103ZB+BDq9J5SV3DY:CSVVEPozmB7vB+FqX5S1D

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2976	2988	rundll32.exe	28
PID 2988 wrote to memory of 2976	2988	rundll32.exe	28
PID 2988 wrote to memory of 2976	2988	rundll32.exe	28
PID 2988 wrote to memory of 2976	2988	rundll32.exe	28
PID 2988 wrote to memory of 2976	2988	rundll32.exe	28
PID 2988 wrote to memory of 2976	2988	rundll32.exe	28
PID 2988 wrote to memory of 2976	2988	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\099bdc64230165448a9f291df9136eb0_NEIKI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\099bdc64230165448a9f291df9136eb0_NEIKI.dll,#1
  2⤵
  PID:2976