050263331fbf2890d6a2b4fe5c8a2ac49ceb3d2a8d5d563ad89aec87feb6ce98

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 22:10

Target

050263331fbf2890d6a2b4fe5c8a2ac49ceb3d2a8d5d563ad89aec87feb6ce98_NeikiAnalytics.dll
Size

3.7MB
MD5

95b57e8308d8381af90ecf81d4a88270
SHA1

281af8e192dc3aa2043086cecae66c5a40aacf84
SHA256

050263331fbf2890d6a2b4fe5c8a2ac49ceb3d2a8d5d563ad89aec87feb6ce98
SHA512

11d8d65c46be759350e90d951d085ada1ecab91e81460051ed72309b4328d6204fadfde058c547f9f56113cb6bb7a84bc14576ae92b40fdc8493c7f2a9bfe85c
SSDEEP

98304:BpnlWxJez0NDyUV66fZQTfLTNPWGIbLmek5PPhWC:4bhDyU4JfAG46f5Rt

Score

7^/10

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/2320-1-0x0000000010000000-0x0000000010883000-memory.dmp	vmprotect
behavioral1/memory/2320-2-0x0000000010000000-0x0000000010883000-memory.dmp	vmprotect
behavioral1/memory/2320-0-0x0000000010000000-0x0000000010883000-memory.dmp	vmprotect
behavioral1/memory/2320-3-0x0000000010000000-0x0000000010883000-memory.dmp	vmprotect
behavioral1/memory/2320-4-0x0000000010000000-0x0000000010883000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

2320 rundll32.exe

pid	process
2320	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2700 wrote to memory of 2320	2700	rundll32.exe	rundll32.exe
PID 2700 wrote to memory of 2320	2700	rundll32.exe	rundll32.exe
PID 2700 wrote to memory of 2320	2700	rundll32.exe	rundll32.exe
PID 2700 wrote to memory of 2320	2700	rundll32.exe	rundll32.exe
PID 2700 wrote to memory of 2320	2700	rundll32.exe	rundll32.exe
PID 2700 wrote to memory of 2320	2700	rundll32.exe	rundll32.exe
PID 2700 wrote to memory of 2320	2700	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\050263331fbf2890d6a2b4fe5c8a2ac49ceb3d2a8d5d563ad89aec87feb6ce98_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2700

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\050263331fbf2890d6a2b4fe5c8a2ac49ceb3d2a8d5d563ad89aec87feb6ce98_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2320

memory/2320-1-0x0000000010000000-0x0000000010883000-memory.dmp

Filesize
8.5MB

Download
memory/2320-2-0x0000000010000000-0x0000000010883000-memory.dmp

Filesize
8.5MB

Download
memory/2320-0-0x0000000010000000-0x0000000010883000-memory.dmp

Filesize
8.5MB

Download
memory/2320-3-0x0000000010000000-0x0000000010883000-memory.dmp

Filesize
8.5MB

Download
memory/2320-4-0x0000000010000000-0x0000000010883000-memory.dmp

Filesize
8.5MB

Download