505d0f655546e417496e93c92f1eef1b05b7da3ad5ba22e8a2babd4969f93d14

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:58

Target

67578787c0f462c5bc2b0458afcc0f70_NeikiAnalytics.dll
Size

26KB
MD5

67578787c0f462c5bc2b0458afcc0f70
SHA1

cfc32ce617c851c9bb94db196edef7364b098650
SHA256

505d0f655546e417496e93c92f1eef1b05b7da3ad5ba22e8a2babd4969f93d14
SHA512

3ff2eaa8a81c74a10f8d2ab23913c98bc224df5bdb718245d4b248ceb2c9e6906d3bd41004ca5921870aca9855f74592e583f3859aeb0b3d9bde8810d8ab1a12
SSDEEP

384:EBh7qQDbQCiFLXk06hIQAeu1T+ztAtlkO1aPMD/nIhrzovFz9Gdgy6CfcLd7:gxqQDbfiuhIMP2CO1aPMDS4vFhdLcQJ

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1736-0-0x0000000010000000-0x0000000010017000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2312 1736 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2312	1736	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1772 wrote to memory of 1736	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 1736	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 1736	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 1736	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 1736	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 1736	1772	rundll32.exe	rundll32.exe
PID 1772 wrote to memory of 1736	1772	rundll32.exe	rundll32.exe
PID 1736 wrote to memory of 2312	1736	rundll32.exe	WerFault.exe
PID 1736 wrote to memory of 2312	1736	rundll32.exe	WerFault.exe
PID 1736 wrote to memory of 2312	1736	rundll32.exe	WerFault.exe
PID 1736 wrote to memory of 2312	1736	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\67578787c0f462c5bc2b0458afcc0f70_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1772

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\67578787c0f462c5bc2b0458afcc0f70_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 224
3⤵
- Program crash
PID:2312

memory/1736-0-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download