4369e280407962090a6c9f9e2bc03fc98b5ebea73bed664615bcefd6866cc379

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 11:09

Target

b29ff4a40e8c1c552640e2acd6fa48e0_NeikiAnalytics.dll
Size

34KB
MD5

b29ff4a40e8c1c552640e2acd6fa48e0
SHA1

c6422739f6fd5c5ae5d79bb6bce06d2214da0659
SHA256

4369e280407962090a6c9f9e2bc03fc98b5ebea73bed664615bcefd6866cc379
SHA512

503a9881bc807969ed2509cb9cf8d12d2daeeb3ab17273f52d60917f351cbeb1ca596c684194221ddb28cb5335ca06bc2512f59d23249cc6b046353061b80fe4
SSDEEP

768:Fa3YAz56z8nO/iP5ZvPOkrGZNkp01vJNpFsRt0Q:UcwnO/iP5lPOdgWtJxsL

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1888	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28
PID 2172 wrote to memory of 1888	2172	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b29ff4a40e8c1c552640e2acd6fa48e0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b29ff4a40e8c1c552640e2acd6fa48e0_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1888

memory/1888-0-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/1888-2-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1888-1-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/1888-4-0x00000000774BF000-0x00000000774C0000-memory.dmp

Filesize
4KB

Download
memory/1888-3-0x00000000774C0000-0x00000000774C1000-memory.dmp

Filesize
4KB

Download