7a34c811ebbf7acfbd87b0be68943e847b95f8af24b7faf8f0c3d427406ac951

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 07:13

Target

a0b7b7057ba5e0519ab16628e174c7d0_NeikiAnalytics.dll
Size

76KB
MD5

a0b7b7057ba5e0519ab16628e174c7d0
SHA1

4adb3166502fc0bf8462665355981952627fec80
SHA256

7a34c811ebbf7acfbd87b0be68943e847b95f8af24b7faf8f0c3d427406ac951
SHA512

93cc418ab6deacf3772792350c30ecdf47c405ec43151a32bfc0c87fa5b2b92782dc6d1ceed5d104da24c0154791c8e36a1d9d451d22f57c18767b1532d532ed
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZWN0ea:c8y93KQjy7G55riF1cMo03oNg

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2140-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2140-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2812	2140	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2140	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 2140	1384	rundll32.exe	28
PID 1384 wrote to memory of 2140	1384	rundll32.exe	28
PID 1384 wrote to memory of 2140	1384	rundll32.exe	28
PID 1384 wrote to memory of 2140	1384	rundll32.exe	28
PID 1384 wrote to memory of 2140	1384	rundll32.exe	28
PID 1384 wrote to memory of 2140	1384	rundll32.exe	28
PID 1384 wrote to memory of 2140	1384	rundll32.exe	28
PID 2140 wrote to memory of 2812	2140	rundll32.exe	29
PID 2140 wrote to memory of 2812	2140	rundll32.exe	29
PID 2140 wrote to memory of 2812	2140	rundll32.exe	29
PID 2140 wrote to memory of 2812	2140	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a0b7b7057ba5e0519ab16628e174c7d0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a0b7b7057ba5e0519ab16628e174c7d0_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 304
    3⤵
    - Program crash
    PID:2812

memory/2140-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2140-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download