f8b82ef8600c734319467e640b4fc34c6bbbae5e2a013e6acf4a5ab72501a432

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 07:26

Target

accb88cb33819bf92d3a35985bb6f540_NeikiAnalytics.dll
Size

76KB
MD5

accb88cb33819bf92d3a35985bb6f540
SHA1

f895f3e09c13303e08c3bbf43fb4cac8156182ca
SHA256

f8b82ef8600c734319467e640b4fc34c6bbbae5e2a013e6acf4a5ab72501a432
SHA512

475a3ff55d3789105d6667966a34024391d20e22619bd80f6b87e7120c661190702df702c33198034a2fe6308263117747bd3e402a5781d5bfa63e8f5543c4ae
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZqwHHfTcOPNHOD:c8y93KQjy7G55riF1cMo03yD

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3404-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3404-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2332	3404	WerFault.exe	80

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3404	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 3404	4468	rundll32.exe	80
PID 4468 wrote to memory of 3404	4468	rundll32.exe	80
PID 4468 wrote to memory of 3404	4468	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\accb88cb33819bf92d3a35985bb6f540_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\accb88cb33819bf92d3a35985bb6f540_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 712
    3⤵
    - Program crash
    PID:2332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3404 -ip 3404
1⤵
PID:1624

memory/3404-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3404-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download