60be88d0ff99f75fb9df11de1b6a0a944bf6451bae26d529aae4453049fc290b

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 13:29

Target
a4ff76a10bd350b2a3f8d9aeb0429f10_NeikiAnalytics.dll
Size 34KB
Sample240603-qrmjyahd65
SHA256 60be88d0ff99f75fb9df11de1b6a0a944bf6451bae26d529aae4453049fc290b
MD5 a4ff76a10bd350b2a3f8d9aeb0429f10
SHA1 df6b8742971c41ccab51c2eb93f5496c78544a54
SHA512 0efd9cad1967860efc87a3513e9047fd4a52660feeb703f9e588b99b4f87e90c06c92302900d7d3bb46f29caa94b0be3fa19b7d67eafc9d2d0ede7ddeff75df3
SSDEEP 768:Fa3YAz56z8nO/iP5ZvPOkrGZNkp01vJNpFsRtfOjQ:UcwnO/iP5lPOdgWtJxsLfO
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5076	2320	WerFault.exe	81

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2320	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 2320	1056	rundll32.exe	81
PID 1056 wrote to memory of 2320	1056	rundll32.exe	81
PID 1056 wrote to memory of 2320	1056	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4ff76a10bd350b2a3f8d9aeb0429f10_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4ff76a10bd350b2a3f8d9aeb0429f10_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 856
    3⤵
    - Program crash
    PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2320 -ip 2320
1⤵
PID:4432

memory/2320-3-0x0000000077DC2000-0x0000000077DC3000-memory.dmp

Download

memory/2320-2-0x0000000000D90000-0x0000000000D91000-memory.dmp

Download

memory/2320-1-0x0000000000D80000-0x0000000000D81000-memory.dmp

Download

memory/2320-0-0x0000000000D30000-0x0000000000D31000-memory.dmp

Download

memory/2320-4-0x0000000077DC2000-0x0000000077DC3000-memory.dmp

Download