2278f61dac6b48d19b36eb5253bb6539e5c8b137979ccb88371d084359babe89

Analysis

max time kernel
141s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 09:35

Target

0d513e698319c70838ee414defc5fa70_NEIKI.dll
Size

76KB
MD5

0d513e698319c70838ee414defc5fa70
SHA1

61e16c7f6e77545b78e3a03afcaf986debb93087
SHA256

2278f61dac6b48d19b36eb5253bb6539e5c8b137979ccb88371d084359babe89
SHA512

f84101cee61fc97ee10a717e455cf4d7872d1546aabf955dded9e8b859145c24eba507e92d4ce41b3a49c63d32736446422a197dca5e59fa2a82aae435568749
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7Zt8V7:c8y93KQjy7G55riF1cMo03r8V7

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1556-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/1556-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1096	1556	WerFault.exe	83

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1556	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1556	1584	rundll32.exe	83
PID 1584 wrote to memory of 1556	1584	rundll32.exe	83
PID 1584 wrote to memory of 1556	1584	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d513e698319c70838ee414defc5fa70_NEIKI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d513e698319c70838ee414defc5fa70_NEIKI.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 712
    3⤵
    - Program crash
    PID:1096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1556 -ip 1556
1⤵
PID:544

memory/1556-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1556-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download