f032591ff92ac9f36254adcab78f85d13f6c7559ecd0e7cb782d3c49db70ca1b | Triage

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 23:56

Sharing

Report Analysis Logs

General

Target

nEO iMAGING/niUtils2.dll
Size

312KB
MD5

f327a8e9d88bfa11e806faca0e17c7da
SHA1

883f5c2142380f9fa04bd4c418670fe71b8aee9e
SHA256

cf14ce795dd22236ebde91177cbe63639e07c3d23349d664349793022a6b6ee7
SHA512

062f01b6a9835bd764ea921fc3d94c7f8db82b335bd88ec3b10d0ba653052c892d32de1f743c6b061836674c5a5878b94254e30105956252197353142ba04ea2
SSDEEP

6144:UEdXJJcx19mjvUZ8Oviwj8Z/imVTR/4Z/m3Y6eAO7tq:bJcx19qva8OKwjG6ihHI6eG

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 1916	2120	rundll32.exe	31
PID 2120 wrote to memory of 1916	2120	rundll32.exe	31
PID 2120 wrote to memory of 1916	2120	rundll32.exe	31
PID 2120 wrote to memory of 1916	2120	rundll32.exe	31
PID 2120 wrote to memory of 1916	2120	rundll32.exe	31
PID 2120 wrote to memory of 1916	2120	rundll32.exe	31
PID 2120 wrote to memory of 1916	2120	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\nEO iMAGING\niUtils2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\nEO iMAGING\niUtils2.dll",#1
  2⤵
  PID:1916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads