c76a61029081f01222b230ff125938569b7a7dcd0fd68c6edededb30db468044

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 14:44

Target

e742461ec4961f9b4faf228860b8ed10_NeikiAnalytics.dll
Size

5.2MB
MD5

e742461ec4961f9b4faf228860b8ed10
SHA1

7cc31e0320c46668a7ebc7f441534fb841f1b029
SHA256

c76a61029081f01222b230ff125938569b7a7dcd0fd68c6edededb30db468044
SHA512

744190e7064f1c8b134c0a1937bda549fa281b6aac12ed7d920ef2f8406103da7cdd6dd112ad7f5ef4ed2400e18593603bc4ceb772d63e39b8c55ed2753569f1
SSDEEP

98304:IP9UokYumczhd5cQoatkv9LRjmAO3Hv4stpDpvb0koTEC:IP9FNuDzhXcQoatkvXjmTHv4sjR0koT

Score

5^/10

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\version_description.xml	rundll32.exe
File created	C:\Windows\SysWOW64\version.xml	rundll32.exe
File created	C:\Windows\SysWOW64\HintSock.dll	rundll32.exe
File created	C:\Windows\SysWOW64\HintSok.dll	rundll32.exe
File created	C:\Windows\SysWOW64\Hintva.dll	rundll32.exe
File created	C:\Windows\SysWOW64\version	rundll32.exe
File created	C:\Windows\SysWOW64\13092618\hintva.dll	rundll32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1512	rundll32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1512	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 1512	1296	rundll32.exe	81
PID 1296 wrote to memory of 1512	1296	rundll32.exe	81
PID 1296 wrote to memory of 1512	1296	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e742461ec4961f9b4faf228860b8ed10_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e742461ec4961f9b4faf228860b8ed10_NeikiAnalytics.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1512

memory/1512-0-0x0000000010000000-0x0000000010538000-memory.dmp

Filesize
5.2MB

Download