67e7fc7c9237d97f160c8f7d170c329e7d7db0b6cad13e5dd4a1221cc251386c

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 21:59

Target

248af4458eb0d584bf03ab51aaa9b250_NeikiAnalytics.dll
Size

80KB
MD5

248af4458eb0d584bf03ab51aaa9b250
SHA1

a08d64f2874085cf900489a3d5ad91babd4844d1
SHA256

67e7fc7c9237d97f160c8f7d170c329e7d7db0b6cad13e5dd4a1221cc251386c
SHA512

130fe93b8445fea3d21a11433c26e8d8ab0a0109afb0d0da3bb0b49d00e86631dd9838da135275d7bcd2e040a6a8158a75bf28d7cf5677c357ee3c8d1e5ab2f7
SSDEEP

1536:5POOhfbOjovgdVydUgoNrwBZXGDaZ1QIxrfItMgR7ZaO+fGxHZPEtcA03f:5dbwovEVyqgoZmZXWfIdQdRaefPMcA0P

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2480-0-0x0000000010000000-0x0000000010033000-memory.dmp	upx
behavioral1/memory/2480-1-0x0000000010000000-0x0000000010033000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2432	2480	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2480	rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2480	2416	rundll32.exe	28
PID 2416 wrote to memory of 2480	2416	rundll32.exe	28
PID 2416 wrote to memory of 2480	2416	rundll32.exe	28
PID 2416 wrote to memory of 2480	2416	rundll32.exe	28
PID 2416 wrote to memory of 2480	2416	rundll32.exe	28
PID 2416 wrote to memory of 2480	2416	rundll32.exe	28
PID 2416 wrote to memory of 2480	2416	rundll32.exe	28
PID 2480 wrote to memory of 2108	2480	rundll32.exe	30
PID 2480 wrote to memory of 2108	2480	rundll32.exe	30
PID 2480 wrote to memory of 2108	2480	rundll32.exe	30
PID 2480 wrote to memory of 2108	2480	rundll32.exe	30
PID 2480 wrote to memory of 2432	2480	rundll32.exe	29
PID 2480 wrote to memory of 2432	2480	rundll32.exe	29
PID 2480 wrote to memory of 2432	2480	rundll32.exe	29
PID 2480 wrote to memory of 2432	2480	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\248af4458eb0d584bf03ab51aaa9b250_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\248af4458eb0d584bf03ab51aaa9b250_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 328
    3⤵
    - Program crash
    PID:2432
- - C:\Windows\SysWOW64\arp.exe
    arp -a
    3⤵
    PID:2108

memory/2480-0-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/2480-1-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download