7468dfc6a2cc85d153b38af126992ca0bed2837914738da1b9ed43d511bb90f0

Analysis

max time kernel
139s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 16:50

Target

04bfb417ef6bde77729f41d0242af4a0_NeikiAnalytics.exe
Size

71KB
MD5

04bfb417ef6bde77729f41d0242af4a0
SHA1

2b01904ed0754cf430bd8e859e2e42f5cd638e69
SHA256

7468dfc6a2cc85d153b38af126992ca0bed2837914738da1b9ed43d511bb90f0
SHA512

1427f37e64f1e8776de0d7396e13ea23f7a8f7146ccdc18ba4d9c33d29cee4dc16cf37fd0657bf2d76414020c3a0bf6a7ba36ed57bec92f093edabd2f63de70b
SSDEEP

768:hZZ6Zyf9ei1kK4GJrydY8O8oM+9asPW+JXr7QILPcMLopRgVdfbII8CQ7QHt08F6:14K8Y1XVVkgVdrI7Q3FIskXJJD

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3912	esmooviv.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\esmooviv.exe	04bfb417ef6bde77729f41d0242af4a0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\esmooviv.exe	04bfb417ef6bde77729f41d0242af4a0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\04bfb417ef6bde77729f41d0242af4a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\04bfb417ef6bde77729f41d0242af4a0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
PID:4780
- C:\Windows\SysWOW64\esmooviv.exe
  "C:\Windows\SysWOW64\esmooviv.exe"
  2⤵
  - Executes dropped EXE
  PID:3912

C:\Windows\SysWOW64\esmooviv.exe

Filesize
68KB

MD5
347c91aefbb117e5a61f5ebd76db014e

SHA1
c9ef68aab02f9123164ddafc0c262123fcc55a9f

SHA256
f5f827fa1e6431c7645968bf8eca7fbe08b20b1317fb4fbe3ca7e52e8492805d

SHA512
1896e4a7476c16216c81b8c48337087b9990e4790296e17c6e1318f2547b2fb2b6a75adc0a11315bf7c101457e3377a9b50631e38dd0055eaada13cef7a8735a

Download Submit
memory/4780-2-0x0000000077562000-0x0000000077563000-memory.dmp

Filesize
4KB

Download
memory/4780-4-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download