42735ddb87d51075652af8b62452645539a1d340b98d436f2dd6fc3cae203311

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 05:17

Target

42735ddb87d51075652af8b62452645539a1d340b98d436f2dd6fc3cae203311_NeikiAnalytics.dll
Size

76KB
MD5

62ef5bde0d7ded6f6e34adf197993b70
SHA1

6798d06ea42acac540ff04d5b90aa2ddff0687d6
SHA256

42735ddb87d51075652af8b62452645539a1d340b98d436f2dd6fc3cae203311
SHA512

e30d2484b669f25df538c59c648ef88ff8ead5771cae72faab170b4810321514547dfc258b217fb6ac0407157daa51bde818521a7f5c1a1b78230ef9e8369f8e
SSDEEP

1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7Z72Ur:c8y93KQjy7G55riF1cMo03hxr

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1576-0-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/1576-1-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4880	1576	WerFault.exe	81

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1576	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 1576	560	rundll32.exe	81
PID 560 wrote to memory of 1576	560	rundll32.exe	81
PID 560 wrote to memory of 1576	560	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\42735ddb87d51075652af8b62452645539a1d340b98d436f2dd6fc3cae203311_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\42735ddb87d51075652af8b62452645539a1d340b98d436f2dd6fc3cae203311_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 712
    3⤵
    - Program crash
    PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1576 -ip 1576
1⤵
PID:3712

memory/1576-0-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/1576-1-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download