9af8439b040de119515b3a4c4c06a5f4de4b16bb8465bf7d743daa9171325d23

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:38

Target
541c111cd6a19930cc9a09aacc919c80_NeikiAnalytics.dll
Size 2.4MB
Sample240613-b2ff2szbmb
SHA256 9af8439b040de119515b3a4c4c06a5f4de4b16bb8465bf7d743daa9171325d23
MD5 541c111cd6a19930cc9a09aacc919c80
SHA1 57a4eb0babed8f95b45f5a3cf103111582c46c90
SHA512 6f202cdba7e7057f36f5969c06b731e6014031674b865a12f1e3c9f49ba8e0c6c8317784c58ce08fd6f41ee2372984b3227a42753357fdbc9a62b5f320eb97ff
SSDEEP 49152:CcwBjnTqliu/wcH60hiiP+Ydr3YcwRd0ifWnlAHzXZ4msLwpe2i8TGXkTu/X:pwdnTowcHd0ij2cwROZlAHzXZdsLwI24
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3712-0-0x0000000074DC0000-0x0000000075185000-memory.dmp	upx
behavioral2/memory/3712-1-0x0000000074DC0000-0x0000000075185000-memory.dmp	upx
behavioral2/memory/3712-2-0x0000000074DC0000-0x0000000075185000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4932	3712	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 3712	2428	rundll32.exe	90
PID 2428 wrote to memory of 3712	2428	rundll32.exe	90
PID 2428 wrote to memory of 3712	2428	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\541c111cd6a19930cc9a09aacc919c80_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\541c111cd6a19930cc9a09aacc919c80_NeikiAnalytics.dll,#1
  2⤵
  PID:3712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 636
    3⤵
    - Program crash
    PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3712 -ip 3712
1⤵
PID:4740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:3636

memory/3712-0-0x0000000074DC0000-0x0000000075185000-memory.dmp

Download

memory/3712-1-0x0000000074DC0000-0x0000000075185000-memory.dmp

Download

memory/3712-2-0x0000000074DC0000-0x0000000075185000-memory.dmp

Download