9f278a982bf18fa6303868ae34dc819a9177242ed9ed2fc9b4dd0da9b98657fc

Analysis

max time kernel
132s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 15:43

Target

9f278a982bf18fa6303868ae34dc819a9177242ed9ed2fc9b4dd0da9b98657fc_NeikiAnalytics.dll
Size

1.6MB
MD5

8a2ca4cdabed715572e77a94fcbcd200
SHA1

f2008597290e0b0c3e959f2460d7490bb6f68303
SHA256

9f278a982bf18fa6303868ae34dc819a9177242ed9ed2fc9b4dd0da9b98657fc
SHA512

205f276c60bd46135b2079409ef46c214ce2fcff25c0205504093d868592c9b48965f89ede6291b301bd8922ad587bd0f7897ab5a7f44ffe16dad856d22a7583
SSDEEP

49152:oXirEAb2mwQbtVuAIGmhqduRXWKLTU3huAV7/O:oSqCIAJmWQXWoTU3huAV72

Score

7^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2548-0-0x0000000010000000-0x000000001033E000-memory.dmp	upx
behavioral2/memory/2548-1-0x0000000000BC0000-0x0000000000BCB000-memory.dmp	upx
behavioral2/memory/2548-2-0x0000000000BC0000-0x0000000000BCB000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2548	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2548	2528	rundll32.exe	92
PID 2528 wrote to memory of 2548	2528	rundll32.exe	92
PID 2528 wrote to memory of 2548	2528	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f278a982bf18fa6303868ae34dc819a9177242ed9ed2fc9b4dd0da9b98657fc_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9f278a982bf18fa6303868ae34dc819a9177242ed9ed2fc9b4dd0da9b98657fc_NeikiAnalytics.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4132,i,3671441404766730751,12082497324212183132,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:8
1⤵
PID:412

memory/2548-0-0x0000000010000000-0x000000001033E000-memory.dmp

Filesize
3.2MB

Download
memory/2548-1-0x0000000000BC0000-0x0000000000BCB000-memory.dmp

Filesize
44KB

Download
memory/2548-2-0x0000000000BC0000-0x0000000000BCB000-memory.dmp

Filesize
44KB

Download