4369e280407962090a6c9f9e2bc03fc98b5ebea73bed664615bcefd6866cc379

Analysis

max time kernel
131s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 11:09

Target

b29ff4a40e8c1c552640e2acd6fa48e0_NeikiAnalytics.dll
Size

34KB
MD5

b29ff4a40e8c1c552640e2acd6fa48e0
SHA1

c6422739f6fd5c5ae5d79bb6bce06d2214da0659
SHA256

4369e280407962090a6c9f9e2bc03fc98b5ebea73bed664615bcefd6866cc379
SHA512

503a9881bc807969ed2509cb9cf8d12d2daeeb3ab17273f52d60917f351cbeb1ca596c684194221ddb28cb5335ca06bc2512f59d23249cc6b046353061b80fe4
SSDEEP

768:Fa3YAz56z8nO/iP5ZvPOkrGZNkp01vJNpFsRt0Q:UcwnO/iP5lPOdgWtJxsL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3432	2528	WerFault.exe	83

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2528	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 736 wrote to memory of 2528	736	rundll32.exe	83
PID 736 wrote to memory of 2528	736	rundll32.exe	83
PID 736 wrote to memory of 2528	736	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b29ff4a40e8c1c552640e2acd6fa48e0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b29ff4a40e8c1c552640e2acd6fa48e0_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 840
    3⤵
    - Program crash
    PID:3432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2528 -ip 2528
1⤵
PID:3304

memory/2528-2-0x0000000000F60000-0x0000000000F61000-memory.dmp

Filesize
4KB

Download
memory/2528-1-0x0000000000F50000-0x0000000000F51000-memory.dmp

Filesize
4KB

Download
memory/2528-0-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/2528-3-0x0000000077D02000-0x0000000077D03000-memory.dmp

Filesize
4KB

Download
memory/2528-4-0x0000000077D02000-0x0000000077D03000-memory.dmp

Filesize
4KB

Download