42735ddb87d51075652af8b62452645539a1d340b98d436f2dd6fc3cae203311

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 05:17

Target

42735ddb87d51075652af8b62452645539a1d340b98d436f2dd6fc3cae203311_NeikiAnalytics.dll
Size

76KB
MD5

62ef5bde0d7ded6f6e34adf197993b70
SHA1

6798d06ea42acac540ff04d5b90aa2ddff0687d6
SHA256

42735ddb87d51075652af8b62452645539a1d340b98d436f2dd6fc3cae203311
SHA512

e30d2484b669f25df538c59c648ef88ff8ead5771cae72faab170b4810321514547dfc258b217fb6ac0407157daa51bde818521a7f5c1a1b78230ef9e8369f8e
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7Z72Ur:c8y93KQjy7G55riF1cMo03hxr

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/3020-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/3020-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/3020-8-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2692	3020	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3020	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 3020	2988	rundll32.exe	28
PID 2988 wrote to memory of 3020	2988	rundll32.exe	28
PID 2988 wrote to memory of 3020	2988	rundll32.exe	28
PID 2988 wrote to memory of 3020	2988	rundll32.exe	28
PID 2988 wrote to memory of 3020	2988	rundll32.exe	28
PID 2988 wrote to memory of 3020	2988	rundll32.exe	28
PID 2988 wrote to memory of 3020	2988	rundll32.exe	28
PID 3020 wrote to memory of 2692	3020	rundll32.exe	29
PID 3020 wrote to memory of 2692	3020	rundll32.exe	29
PID 3020 wrote to memory of 2692	3020	rundll32.exe	29
PID 3020 wrote to memory of 2692	3020	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\42735ddb87d51075652af8b62452645539a1d340b98d436f2dd6fc3cae203311_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\42735ddb87d51075652af8b62452645539a1d340b98d436f2dd6fc3cae203311_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 312
    3⤵
    - Program crash
    PID:2692

memory/3020-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3020-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/3020-2-0x0000000000070000-0x0000000000071000-memory.dmp

Filesize
4KB

Download
memory/3020-8-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download