2e1814ff063945f8c1b4d394e57d584816a9f1e9107df33041daf75e454ae827

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 23:38

Target

27506ffb7d6c2e7031c57a73f76493d0_NeikiAnalytics.dll
Size

34KB
MD5

27506ffb7d6c2e7031c57a73f76493d0
SHA1

6467692854863340cff8f04ee25146853f648643
SHA256

2e1814ff063945f8c1b4d394e57d584816a9f1e9107df33041daf75e454ae827
SHA512

1a6659b422a606fbc9599de2df048cd4d5c66bf6e397497c8b09a450bd081777664ada3838612f49598857f5d3da9fc92d41495342046da8a5af0c62fe5e9668
SSDEEP

768:Fa3YAz56z8nO/iP5ZvPOkrGZNkp01vJNpFsRtoQ:UcwnO/iP5lPOdgWtJxsL

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2204	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2204	1688	rundll32.exe	28
PID 1688 wrote to memory of 2204	1688	rundll32.exe	28
PID 1688 wrote to memory of 2204	1688	rundll32.exe	28
PID 1688 wrote to memory of 2204	1688	rundll32.exe	28
PID 1688 wrote to memory of 2204	1688	rundll32.exe	28
PID 1688 wrote to memory of 2204	1688	rundll32.exe	28
PID 1688 wrote to memory of 2204	1688	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27506ffb7d6c2e7031c57a73f76493d0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\27506ffb7d6c2e7031c57a73f76493d0_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2204

memory/2204-0-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2204-2-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/2204-1-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2204-4-0x0000000077AAF000-0x0000000077AB0000-memory.dmp

Filesize
4KB

Download
memory/2204-3-0x0000000077AB0000-0x0000000077AB1000-memory.dmp

Filesize
4KB

Download