505d0f655546e417496e93c92f1eef1b05b7da3ad5ba22e8a2babd4969f93d14

Analysis

max time kernel
133s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:58

Target

67578787c0f462c5bc2b0458afcc0f70_NeikiAnalytics.dll
Size

26KB
MD5

67578787c0f462c5bc2b0458afcc0f70
SHA1

cfc32ce617c851c9bb94db196edef7364b098650
SHA256

505d0f655546e417496e93c92f1eef1b05b7da3ad5ba22e8a2babd4969f93d14
SHA512

3ff2eaa8a81c74a10f8d2ab23913c98bc224df5bdb718245d4b248ceb2c9e6906d3bd41004ca5921870aca9855f74592e583f3859aeb0b3d9bde8810d8ab1a12
SSDEEP

384:EBh7qQDbQCiFLXk06hIQAeu1T+ztAtlkO1aPMD/nIhrzovFz9Gdgy6CfcLd7:gxqQDbfiuhIMP2CO1aPMDS4vFhdLcQJ

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/1616-0-0x0000000010000000-0x0000000010017000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3820 1616 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3820	1616	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 952 wrote to memory of 1616	952	rundll32.exe	rundll32.exe
PID 952 wrote to memory of 1616	952	rundll32.exe	rundll32.exe
PID 952 wrote to memory of 1616	952	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\67578787c0f462c5bc2b0458afcc0f70_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:952

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\67578787c0f462c5bc2b0458afcc0f70_NeikiAnalytics.dll,#1
2⤵
PID:1616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 600
3⤵
- Program crash
PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1616 -ip 1616
1⤵
PID:2540

memory/1616-0-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download