df4ce5a5e291a2bdc312ee24d191c854c62badf1bc6c30d926bb03b8879ac384

Analysis

max time kernel
140s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 22:29

Target
51b644a6347ae438562043965720c650_NEIKI.exe
Size 73KB
Sample240507-2emjysbe2s
SHA256 df4ce5a5e291a2bdc312ee24d191c854c62badf1bc6c30d926bb03b8879ac384
MD5 51b644a6347ae438562043965720c650
SHA1 f7105a4ab661560b90cef648501cc774635a459e
SHA512 4e465e826da9de3b54c361d30c67b7ca5882a9be78f017fc2fef1eb92d8f9ceed926690a5a31bd454d7d47c4377c7f726def0ba91cb81ffdfdab94aaf7771586
SSDEEP 1536:1y9REHv+R1IFVTvutLebJI6n9IRw4VXFLM1NfGKx:YO27SV4s5xMabf1
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2412	egtivad.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\egtivad.exe	51b644a6347ae438562043965720c650_NEIKI.exe
File created	C:\Windows\SysWOW64\egtivad.exe	51b644a6347ae438562043965720c650_NEIKI.exe

C:\Users\Admin\AppData\Local\Temp\51b644a6347ae438562043965720c650_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\51b644a6347ae438562043965720c650_NEIKI.exe"
1⤵
- Drops file in System32 directory
PID:2548
- C:\Windows\SysWOW64\egtivad.exe
  "C:\Windows\SysWOW64\egtivad.exe"
  2⤵
  - Executes dropped EXE
  PID:2412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:4648

egtivad.exe

Path C:\Windows\SysWOW64\egtivad.exe
Size 70KB
SHA256 6105dc77d2e8b186c166ab40b61d9f7e90f3c0207e97fda88bf24f26b555d39c
MD5 ad19b0250710bbeba6ad12943c364017
SHA1 9ef217160906a1da4cc6cff06ea8e4a5b3fcde8f
SHA512 516871d8cc9b30cd010b36245743c4cbc4b1013c012f9ee233f4dd41622b2fb24eb09e85ea3688bc0d106f35d1b24605ab77037d1f4db3dd43b80762597fcf65
SSDEEP 1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slX:Olg35GTslA5t3/w8s
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2548-0-0x0000000077552000-0x0000000077553000-memory.dmp

Download

memory/2548-4-0x0000000000400000-0x0000000000403000-memory.dmp

Download