2e1814ff063945f8c1b4d394e57d584816a9f1e9107df33041daf75e454ae827

Analysis

max time kernel
129s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 23:38

Target

27506ffb7d6c2e7031c57a73f76493d0_NeikiAnalytics.dll
Size

34KB
MD5

27506ffb7d6c2e7031c57a73f76493d0
SHA1

6467692854863340cff8f04ee25146853f648643
SHA256

2e1814ff063945f8c1b4d394e57d584816a9f1e9107df33041daf75e454ae827
SHA512

1a6659b422a606fbc9599de2df048cd4d5c66bf6e397497c8b09a450bd081777664ada3838612f49598857f5d3da9fc92d41495342046da8a5af0c62fe5e9668
SSDEEP

768:Fa3YAz56z8nO/iP5ZvPOkrGZNkp01vJNpFsRtoQ:UcwnO/iP5lPOdgWtJxsL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3372	1804	WerFault.exe	82

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1804	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 1804	1876	rundll32.exe	82
PID 1876 wrote to memory of 1804	1876	rundll32.exe	82
PID 1876 wrote to memory of 1804	1876	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\27506ffb7d6c2e7031c57a73f76493d0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\27506ffb7d6c2e7031c57a73f76493d0_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 852
    3⤵
    - Program crash
    PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1804 -ip 1804
1⤵
PID:672

memory/1804-2-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/1804-3-0x0000000077BE2000-0x0000000077BE3000-memory.dmp

Filesize
4KB

Download
memory/1804-1-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Filesize
4KB

Download
memory/1804-0-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Filesize
4KB

Download
memory/1804-4-0x0000000077BE2000-0x0000000077BE3000-memory.dmp

Filesize
4KB

Download