2cb03cc62d882bac63b2575281f97a6662247a2e88eee2933d19be453eddcff7

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 00:38

Target

40d9a2f50c4f6bf4e216ae558ac47b80_NeikiAnalytics.dll
Size

76KB
MD5

40d9a2f50c4f6bf4e216ae558ac47b80
SHA1

b08f649503c5832ba8407f826114ae83a4d96528
SHA256

2cb03cc62d882bac63b2575281f97a6662247a2e88eee2933d19be453eddcff7
SHA512

aca53ce362b0f404d5df3d19645d6b8f5239b0a4353b124b1e3ec99c8fa1ffe03550bed2cf6b7019bba14719197a2b048cb13c7c09cced3994995bfe5ed79af2
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7Zdg7G:c8y93KQjy7G55riF1cMo03j/

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2040-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2040-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2040-2-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2040-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1712	2040	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2040	2116	rundll32.exe	28
PID 2116 wrote to memory of 2040	2116	rundll32.exe	28
PID 2116 wrote to memory of 2040	2116	rundll32.exe	28
PID 2116 wrote to memory of 2040	2116	rundll32.exe	28
PID 2116 wrote to memory of 2040	2116	rundll32.exe	28
PID 2116 wrote to memory of 2040	2116	rundll32.exe	28
PID 2116 wrote to memory of 2040	2116	rundll32.exe	28
PID 2040 wrote to memory of 1712	2040	rundll32.exe	29
PID 2040 wrote to memory of 1712	2040	rundll32.exe	29
PID 2040 wrote to memory of 1712	2040	rundll32.exe	29
PID 2040 wrote to memory of 1712	2040	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40d9a2f50c4f6bf4e216ae558ac47b80_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\40d9a2f50c4f6bf4e216ae558ac47b80_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 328
    3⤵
    - Program crash
    PID:1712

memory/2040-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2040-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2040-2-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2040-3-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download