ad944b6d75abc1b06b0efed3a4e667547500599d62691888c29fc1c66600c71d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 05:15

Target

8ed322d84f9fb7744d5617a0ee8b87f0_NeikiAnalytics.dll
Size

33KB
MD5

8ed322d84f9fb7744d5617a0ee8b87f0
SHA1

886d130b7eabd6ae4ab4b59ba83c64278746b1bc
SHA256

ad944b6d75abc1b06b0efed3a4e667547500599d62691888c29fc1c66600c71d
SHA512

5a4a6d6db30ac484470ed966e26741c1e89f8987c57f3821d05c4d238f16f811b8485c1e5c8e3d9d25e2504b8340292da64dbe04fd3d9a126a88d53fc03fb966
SSDEEP

768:GbDY7+0eqFodN99X0fNgaQyNhKb/aZoan:GbMr6N99X0fdNAbSo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2120	2664	WerFault.exe	83

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2664	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 2664	3972	rundll32.exe	83
PID 3972 wrote to memory of 2664	3972	rundll32.exe	83
PID 3972 wrote to memory of 2664	3972	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ed322d84f9fb7744d5617a0ee8b87f0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ed322d84f9fb7744d5617a0ee8b87f0_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 868
    3⤵
    - Program crash
    PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2664 -ip 2664
1⤵
PID:4440

memory/2664-1-0x0000000001200000-0x0000000001201000-memory.dmp

Filesize
4KB

Download
memory/2664-0-0x00000000011F0000-0x00000000011F1000-memory.dmp

Filesize
4KB

Download
memory/2664-2-0x0000000077D82000-0x0000000077D83000-memory.dmp

Filesize
4KB

Download