fc0ea8ef6368de3aefd259862cf4b2bea63c4fb8af471b85acaa24c408e53e8b

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 06:53

Target

692058eb1ab564c00572062e794c1210_NeikiAnalytics.dll
Size

34KB
MD5

692058eb1ab564c00572062e794c1210
SHA1

a5f702b8f63578b47250db6b03912fdc2bbf2e71
SHA256

fc0ea8ef6368de3aefd259862cf4b2bea63c4fb8af471b85acaa24c408e53e8b
SHA512

f492e051fd37331bbe357974a8f963f387009f5e6e452af7b6c296fdadb223364a4f02db621bd3d351d65515696b0f749e53e939f14143c5e355b0919a86bcc1
SSDEEP

768:FH3YA78rMnO/eKTlUNykrGCNIhMKFFimx+5GUL/R/dQ:R4gnO/eKT+NydzWKji5V/F

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2936	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2936	1244	rundll32.exe	28
PID 1244 wrote to memory of 2936	1244	rundll32.exe	28
PID 1244 wrote to memory of 2936	1244	rundll32.exe	28
PID 1244 wrote to memory of 2936	1244	rundll32.exe	28
PID 1244 wrote to memory of 2936	1244	rundll32.exe	28
PID 1244 wrote to memory of 2936	1244	rundll32.exe	28
PID 1244 wrote to memory of 2936	1244	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\692058eb1ab564c00572062e794c1210_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\692058eb1ab564c00572062e794c1210_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2936

memory/2936-0-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2936-1-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/2936-2-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/2936-3-0x0000000077D90000-0x0000000077D91000-memory.dmp

Filesize
4KB

Download
memory/2936-4-0x0000000077D8F000-0x0000000077D90000-memory.dmp

Filesize
4KB

Download