29d26d8b759d0ca77cea9b648e92ddd315919d818b67b804e0e22f2db450a43d

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 01:09

Target

29d26d8b759d0ca77cea9b648e92ddd315919d818b67b804e0e22f2db450a43d_NeikiAnalytics.dll
Size

5.7MB
MD5

ae9ba2b885afa99fad085ee1ea81c7e0
SHA1

8cd6b32ad8a6e20eb632aa03917dc286382a93fe
SHA256

29d26d8b759d0ca77cea9b648e92ddd315919d818b67b804e0e22f2db450a43d
SHA512

52cc127fc5c238d791799fef7af4cf873094376c3493e2800eb447c496e5efd582799cbf1e76b88976670bb1f96c4b01438c84e58db5ab7ba2c852b7247de9f7
SSDEEP

98304:4WMdD6IYebdqFIjW9vGa6JxeCb1/HLk2zJ+HBq9AFRflUlrpdBUFbNhm6VWhB7Fj:LIYebdrEvxaBh/rPuBqQUnd+lNhnQH7x

Score

7^/10

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/2792-5-0x0000000010000000-0x0000000010970000-memory.dmp	vmprotect
behavioral1/memory/2792-10-0x0000000010000000-0x0000000010970000-memory.dmp	vmprotect
behavioral1/memory/2792-11-0x0000000010000000-0x0000000010970000-memory.dmp	vmprotect

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\FT_ET99_API.dll rundll32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2792 rundll32.exe
2792 rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\FT_ET99_API.dll	rundll32.exe

pid	process
2792	rundll32.exe
2792	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2036 wrote to memory of 2792	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 2792	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 2792	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 2792	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 2792	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 2792	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 2792	2036	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\29d26d8b759d0ca77cea9b648e92ddd315919d818b67b804e0e22f2db450a43d_NeikiAnalytics.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036

memory/2792-7-0x0000000010048000-0x00000000103B7000-memory.dmp

Filesize
3.4MB

Download
memory/2792-5-0x0000000010000000-0x0000000010970000-memory.dmp

Filesize
9.4MB

Download
memory/2792-4-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2792-10-0x0000000010000000-0x0000000010970000-memory.dmp

Filesize
9.4MB

Download
memory/2792-2-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2792-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2792-11-0x0000000010000000-0x0000000010970000-memory.dmp

Filesize
9.4MB

Download
memory/2792-12-0x0000000010000000-0x0000000010970000-memory.dmp

Filesize
9.4MB

Download