df4ce5a5e291a2bdc312ee24d191c854c62badf1bc6c30d926bb03b8879ac384

Analysis

max time kernel
140s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 22:29

Target

51b644a6347ae438562043965720c650_NEIKI.exe
Size

73KB
MD5

51b644a6347ae438562043965720c650
SHA1

f7105a4ab661560b90cef648501cc774635a459e
SHA256

df4ce5a5e291a2bdc312ee24d191c854c62badf1bc6c30d926bb03b8879ac384
SHA512

4e465e826da9de3b54c361d30c67b7ca5882a9be78f017fc2fef1eb92d8f9ceed926690a5a31bd454d7d47c4377c7f726def0ba91cb81ffdfdab94aaf7771586
SSDEEP

1536:1y9REHv+R1IFVTvutLebJI6n9IRw4VXFLM1NfGKx:YO27SV4s5xMabf1

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2412	egtivad.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\egtivad.exe	51b644a6347ae438562043965720c650_NEIKI.exe
File created	C:\Windows\SysWOW64\egtivad.exe	51b644a6347ae438562043965720c650_NEIKI.exe

C:\Users\Admin\AppData\Local\Temp\51b644a6347ae438562043965720c650_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\51b644a6347ae438562043965720c650_NEIKI.exe"
1⤵
- Drops file in System32 directory
PID:2548
- C:\Windows\SysWOW64\egtivad.exe
  "C:\Windows\SysWOW64\egtivad.exe"
  2⤵
  - Executes dropped EXE
  PID:2412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:4648

C:\Windows\SysWOW64\egtivad.exe

Filesize
70KB

MD5
ad19b0250710bbeba6ad12943c364017

SHA1
9ef217160906a1da4cc6cff06ea8e4a5b3fcde8f

SHA256
6105dc77d2e8b186c166ab40b61d9f7e90f3c0207e97fda88bf24f26b555d39c

SHA512
516871d8cc9b30cd010b36245743c4cbc4b1013c012f9ee233f4dd41622b2fb24eb09e85ea3688bc0d106f35d1b24605ab77037d1f4db3dd43b80762597fcf65

Download Submit
memory/2548-0-0x0000000077552000-0x0000000077553000-memory.dmp

Filesize
4KB

Download
memory/2548-4-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download