2be48ff5a61bd79ef88b4075503bb6d51a833f43f5d4836f16d11a83deebd869

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 03:38

Target

1b6d33dce6320d714226d19efca81ae0_NeikiAnalytics.dll
Size

76KB
MD5

1b6d33dce6320d714226d19efca81ae0
SHA1

8d1126f7dd77240405286936dfdc5ac69bee1167
SHA256

2be48ff5a61bd79ef88b4075503bb6d51a833f43f5d4836f16d11a83deebd869
SHA512

535e3a19d1efc1e017213f69f42204c0457580b0e2a6259a826b28424c973ad16c4b3842524d514556572b4cb74debc852517a472d6e39d423990fc019b83cac
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZmrVxzuPT:c8y93KQjy7G55riF1cMo03Ixxz+

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4340-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4340-2-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5092	4340	WerFault.exe	79

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4340	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4340	4764	rundll32.exe	79
PID 4764 wrote to memory of 4340	4764	rundll32.exe	79
PID 4764 wrote to memory of 4340	4764	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b6d33dce6320d714226d19efca81ae0_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b6d33dce6320d714226d19efca81ae0_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 680
    3⤵
    - Program crash
    PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4340 -ip 4340
1⤵
PID:3144

memory/4340-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/4340-2-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download