412b2ec69e3c9fdfd2262e9f3cb64b4cb4a5386b32b73917889e1dd8295f22ca

Analysis

max time kernel
134s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 01:30

Target

1d3de4835ed5f1697c68219e3af4a570_NeikiAnalytics.dll
Size

34KB
MD5

1d3de4835ed5f1697c68219e3af4a570
SHA1

2e9d36ef39c3451cf0794ebc13dafd85eca39784
SHA256

412b2ec69e3c9fdfd2262e9f3cb64b4cb4a5386b32b73917889e1dd8295f22ca
SHA512

208f82dcc09e1a079a1057f8db0386943738204f0817c41fd1af190ebea0b3cf3b7c1a5c52731021ac43071c3a3101ef8355c1bab7fff1f43a6deb07676b35b5
SSDEEP

768:Fa3YAz56z8nO/iP5ZvPOkrGZNkp01vJNpFsRtGQ:UcwnO/iP5lPOdgWtJxsL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3616	2096	WerFault.exe	82

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 2096	4436	rundll32.exe	82
PID 4436 wrote to memory of 2096	4436	rundll32.exe	82
PID 4436 wrote to memory of 2096	4436	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d3de4835ed5f1697c68219e3af4a570_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1d3de4835ed5f1697c68219e3af4a570_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 856
    3⤵
    - Program crash
    PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2096 -ip 2096
1⤵
PID:4288

memory/2096-0-0x0000000002A60000-0x0000000002A61000-memory.dmp

Filesize
4KB

Download
memory/2096-1-0x0000000002F00000-0x0000000002F01000-memory.dmp

Filesize
4KB

Download
memory/2096-2-0x0000000002F10000-0x0000000002F11000-memory.dmp

Filesize
4KB

Download
memory/2096-3-0x00000000779B2000-0x00000000779B3000-memory.dmp

Filesize
4KB

Download
memory/2096-4-0x00000000779B2000-0x00000000779B3000-memory.dmp

Filesize
4KB

Download