65e54d8719bce5edded9792d69ac7699d45be8d297c65c6b6954cc2189ff8ecc

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 03:57

Target

8c99079dfdf22bf6b9a43fe68cb622d0_NeikiAnalytics.dll
Size

34KB
MD5

8c99079dfdf22bf6b9a43fe68cb622d0
SHA1

51c65b4a34643f741f97ffea4309b063ab92070a
SHA256

65e54d8719bce5edded9792d69ac7699d45be8d297c65c6b6954cc2189ff8ecc
SHA512

992fb33e367456fb24feba4ae2b4bd2a945455ffdd84c22e8a6f40eeb69a9666656a6691400dcecd5321dc6abc3d8441a31187872bc060c20920ddbf7fad3f1b
SSDEEP

768:Fa3YAz56z8nO/iP5ZvPOkrGZNkp01vJNpFsRt+Q:UcwnO/iP5lPOdgWtJxsL

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2892	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2892	1708	rundll32.exe	28
PID 1708 wrote to memory of 2892	1708	rundll32.exe	28
PID 1708 wrote to memory of 2892	1708	rundll32.exe	28
PID 1708 wrote to memory of 2892	1708	rundll32.exe	28
PID 1708 wrote to memory of 2892	1708	rundll32.exe	28
PID 1708 wrote to memory of 2892	1708	rundll32.exe	28
PID 1708 wrote to memory of 2892	1708	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c99079dfdf22bf6b9a43fe68cb622d0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c99079dfdf22bf6b9a43fe68cb622d0_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2892

memory/2892-0-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/2892-1-0x0000000077330000-0x0000000077331000-memory.dmp

Filesize
4KB

Download
memory/2892-3-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/2892-2-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2892-4-0x000000007732F000-0x0000000077330000-memory.dmp

Filesize
4KB

Download