42f550e44ff38dc42671c5afe02634fc236c711569cd448238d4609dde2ad985

Analysis

max time kernel
131s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 02:06

Target

17f0524fa7cfd192d8d8a7e924789740_NeikiAnalytics.dll
Size

34KB
MD5

17f0524fa7cfd192d8d8a7e924789740
SHA1

d8a32c49f816d2aef91f22b62d6a991fb5043275
SHA256

42f550e44ff38dc42671c5afe02634fc236c711569cd448238d4609dde2ad985
SHA512

1ecf21e082df675a8b00c59d53beb0eb39ce7f4c55d36d672e49a60ad9244239cbabd533edf1c920efaf7f72f4e91f0bf3099f3fd99ec63b2f1ec4d708cab50a
SSDEEP

768:Fa3YAz56z8nO/iP5ZvPOkrGZNkp01vJNpFsRt7Q:UcwnO/iP5lPOdgWtJxsL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1860	1732	WerFault.exe	82

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 1732	4772	rundll32.exe	82
PID 4772 wrote to memory of 1732	4772	rundll32.exe	82
PID 4772 wrote to memory of 1732	4772	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17f0524fa7cfd192d8d8a7e924789740_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\17f0524fa7cfd192d8d8a7e924789740_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 856
    3⤵
    - Program crash
    PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1732 -ip 1732
1⤵
PID:1400

memory/1732-0-0x00000000028B0000-0x00000000028B1000-memory.dmp

Filesize
4KB

Download
memory/1732-1-0x00000000029C0000-0x00000000029C1000-memory.dmp

Filesize
4KB

Download
memory/1732-2-0x00000000029D0000-0x00000000029D1000-memory.dmp

Filesize
4KB

Download
memory/1732-3-0x0000000077282000-0x0000000077283000-memory.dmp

Filesize
4KB

Download
memory/1732-4-0x0000000077282000-0x0000000077283000-memory.dmp

Filesize
4KB

Download