544f25cedf0381803021f4fbb169eefb1993a5a78da8645d32cd35d741162443

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 18:52

Target

0fe5a572a081024cabb418bc9b722b20_NeikiAnalytics.exe
Size

74KB
MD5

0fe5a572a081024cabb418bc9b722b20
SHA1

cb56930bb6cf472557150765d2c70e5d2287a98f
SHA256

544f25cedf0381803021f4fbb169eefb1993a5a78da8645d32cd35d741162443
SHA512

eb651d2bdfe8919322582fe193d9ca1de3d0c20e7b309f355ec70ed80c36fbdf9c5854107ddd6e13c31ecd1bd0ba7d018f3cb963f1bd2467661a567bd4e36cd0
SSDEEP

768:hZZ6Zyf9IsOotoORa9BtsKq59qixs6LD908odASouD/7Vs6U2Y6AdYLSQhOUul8M:1sxd9IKubv9svDzhkiLSQoUulHei26x3

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3000	eskugom.exe

Loads dropped DLL 1 IoCs

pid	Process
1984	0fe5a572a081024cabb418bc9b722b20_NeikiAnalytics.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\eskugom.exe	0fe5a572a081024cabb418bc9b722b20_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\eskugom.exe	0fe5a572a081024cabb418bc9b722b20_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\0fe5a572a081024cabb418bc9b722b20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0fe5a572a081024cabb418bc9b722b20_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:1984
- C:\Windows\SysWOW64\eskugom.exe
  "C:\Windows\SysWOW64\eskugom.exe"
  2⤵
  - Executes dropped EXE
  PID:3000

\Windows\SysWOW64\eskugom.exe

Filesize
71KB

MD5
272b4b1d586efbaab610e5bfd156f1d0

SHA1
f5f87bec5cb1314512a8f1d37e5b2d096709999c

SHA256
1f7787e9edb1afccd2e489423ed146902f220c2f6cf147b86def5ea029a39cf8

SHA512
c1cc2c4b769bf2f3c896eabbdfaa7521037d1a6bd1913fc37c2e5c2b71b78c00715979430459cdb5c7b6095f40cfab143c5c2bf0a76272683331b9f209d1c4ae

Download Submit
memory/1984-5-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download