544f25cedf0381803021f4fbb169eefb1993a5a78da8645d32cd35d741162443

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 18:52

Target

0fe5a572a081024cabb418bc9b722b20_NeikiAnalytics.exe
Size

74KB
MD5

0fe5a572a081024cabb418bc9b722b20
SHA1

cb56930bb6cf472557150765d2c70e5d2287a98f
SHA256

544f25cedf0381803021f4fbb169eefb1993a5a78da8645d32cd35d741162443
SHA512

eb651d2bdfe8919322582fe193d9ca1de3d0c20e7b309f355ec70ed80c36fbdf9c5854107ddd6e13c31ecd1bd0ba7d018f3cb963f1bd2467661a567bd4e36cd0
SSDEEP

768:hZZ6Zyf9IsOotoORa9BtsKq59qixs6LD908odASouD/7Vs6U2Y6AdYLSQhOUul8M:1sxd9IKubv9svDzhkiLSQoUulHei26x3

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
748	eskugom.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\eskugom.exe	0fe5a572a081024cabb418bc9b722b20_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\eskugom.exe	0fe5a572a081024cabb418bc9b722b20_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\0fe5a572a081024cabb418bc9b722b20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0fe5a572a081024cabb418bc9b722b20_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
PID:1216
- C:\Windows\SysWOW64\eskugom.exe
  "C:\Windows\SysWOW64\eskugom.exe"
  2⤵
  - Executes dropped EXE
  PID:748

C:\Windows\SysWOW64\eskugom.exe

Filesize
71KB

MD5
272b4b1d586efbaab610e5bfd156f1d0

SHA1
f5f87bec5cb1314512a8f1d37e5b2d096709999c

SHA256
1f7787e9edb1afccd2e489423ed146902f220c2f6cf147b86def5ea029a39cf8

SHA512
c1cc2c4b769bf2f3c896eabbdfaa7521037d1a6bd1913fc37c2e5c2b71b78c00715979430459cdb5c7b6095f40cfab143c5c2bf0a76272683331b9f209d1c4ae

Download Submit
memory/1216-4-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1216-3-0x0000000077B22000-0x0000000077B23000-memory.dmp

Filesize
4KB

Download