d58aff2807fada0e951618b196bd86628705f21779aafaba3c8a56bd73ba1b81

Analysis

max time kernel
134s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:47

Target

16bb49eb356d37a2de6e45a934a000c0_NeikiAnalytics.exe
Size

2.1MB
MD5

16bb49eb356d37a2de6e45a934a000c0
SHA1

296551e5c0f1ae147ee2c8121912ddec825ffe56
SHA256

d58aff2807fada0e951618b196bd86628705f21779aafaba3c8a56bd73ba1b81
SHA512

570e60fcff0a595719d35dcf0292f1a00b6c82e8257cfc9967e8188dfd2a253d1d05c221fcf9f339a6325b1efcf8e6916db55109385c7013c303da59636e8e95
SSDEEP

49152:ba/3xXBSZ4K5MJ1LvTMxbfsYBYSgxu9+fw4T7w/3FPfUNDZ4:rZ4K5MJabfsYNvfFPfUNF

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

16bb49eb356d37a2de6e45a934a000c0_NeikiAnalytics.exe

description pid process

Token: SeTakeOwnershipPrivilege 940 16bb49eb356d37a2de6e45a934a000c0_NeikiAnalytics.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	940	16bb49eb356d37a2de6e45a934a000c0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\16bb49eb356d37a2de6e45a934a000c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\16bb49eb356d37a2de6e45a934a000c0_NeikiAnalytics.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:940

memory/940-7-0x00000000008F0000-0x0000000000950000-memory.dmp

Filesize
384KB

Download
memory/940-0-0x00000000008F0000-0x0000000000950000-memory.dmp

Filesize
384KB

Download
memory/940-9-0x00000000008F0000-0x0000000000950000-memory.dmp

Filesize
384KB

Download
memory/940-11-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/940-12-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download