df4ce5a5e291a2bdc312ee24d191c854c62badf1bc6c30d926bb03b8879ac384

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 22:29

Target

51b644a6347ae438562043965720c650_NEIKI.exe
Size

73KB
MD5

51b644a6347ae438562043965720c650
SHA1

f7105a4ab661560b90cef648501cc774635a459e
SHA256

df4ce5a5e291a2bdc312ee24d191c854c62badf1bc6c30d926bb03b8879ac384
SHA512

4e465e826da9de3b54c361d30c67b7ca5882a9be78f017fc2fef1eb92d8f9ceed926690a5a31bd454d7d47c4377c7f726def0ba91cb81ffdfdab94aaf7771586
SSDEEP

1536:1y9REHv+R1IFVTvutLebJI6n9IRw4VXFLM1NfGKx:YO27SV4s5xMabf1

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1668	egtivad.exe

Loads dropped DLL 1 IoCs

pid	Process
912	51b644a6347ae438562043965720c650_NEIKI.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\egtivad.exe	51b644a6347ae438562043965720c650_NEIKI.exe
File created	C:\Windows\SysWOW64\egtivad.exe	51b644a6347ae438562043965720c650_NEIKI.exe

C:\Users\Admin\AppData\Local\Temp\51b644a6347ae438562043965720c650_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\51b644a6347ae438562043965720c650_NEIKI.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:912
- C:\Windows\SysWOW64\egtivad.exe
  "C:\Windows\SysWOW64\egtivad.exe"
  2⤵
  - Executes dropped EXE
  PID:1668

\Windows\SysWOW64\egtivad.exe

Filesize
70KB

MD5
ad19b0250710bbeba6ad12943c364017

SHA1
9ef217160906a1da4cc6cff06ea8e4a5b3fcde8f

SHA256
6105dc77d2e8b186c166ab40b61d9f7e90f3c0207e97fda88bf24f26b555d39c

SHA512
516871d8cc9b30cd010b36245743c4cbc4b1013c012f9ee233f4dd41622b2fb24eb09e85ea3688bc0d106f35d1b24605ab77037d1f4db3dd43b80762597fcf65

Download Submit
memory/912-5-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download