412b2ec69e3c9fdfd2262e9f3cb64b4cb4a5386b32b73917889e1dd8295f22ca

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 01:30

Target

1d3de4835ed5f1697c68219e3af4a570_NeikiAnalytics.dll
Size

34KB
MD5

1d3de4835ed5f1697c68219e3af4a570
SHA1

2e9d36ef39c3451cf0794ebc13dafd85eca39784
SHA256

412b2ec69e3c9fdfd2262e9f3cb64b4cb4a5386b32b73917889e1dd8295f22ca
SHA512

208f82dcc09e1a079a1057f8db0386943738204f0817c41fd1af190ebea0b3cf3b7c1a5c52731021ac43071c3a3101ef8355c1bab7fff1f43a6deb07676b35b5
SSDEEP

768:Fa3YAz56z8nO/iP5ZvPOkrGZNkp01vJNpFsRtGQ:UcwnO/iP5lPOdgWtJxsL

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1748	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 1748	1308	rundll32.exe	28
PID 1308 wrote to memory of 1748	1308	rundll32.exe	28
PID 1308 wrote to memory of 1748	1308	rundll32.exe	28
PID 1308 wrote to memory of 1748	1308	rundll32.exe	28
PID 1308 wrote to memory of 1748	1308	rundll32.exe	28
PID 1308 wrote to memory of 1748	1308	rundll32.exe	28
PID 1308 wrote to memory of 1748	1308	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d3de4835ed5f1697c68219e3af4a570_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d3de4835ed5f1697c68219e3af4a570_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1748

memory/1748-2-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1748-3-0x0000000076FF0000-0x0000000076FF1000-memory.dmp

Filesize
4KB

Download
memory/1748-4-0x0000000076FEF000-0x0000000076FF0000-memory.dmp

Filesize
4KB

Download
memory/1748-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1748-0-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download