0bb3a7b99e28fc4bb71c92deaf9e90fc01a8a8d97b8a708323b7ba9eef613c38

Analysis

max time kernel
49s
max time network
86s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 07:04

Target

0bb3a7b99e28fc4bb71c92deaf9e90fc01a8a8d97b8a708323b7ba9eef613c38.exe
Size

401KB
MD5

739676045a33e2d8ba3d1bebf7f1c3c0
SHA1

fdb1c04c82be62512d3a975293ff11631190c19a
SHA256

0bb3a7b99e28fc4bb71c92deaf9e90fc01a8a8d97b8a708323b7ba9eef613c38
SHA512

3557f11089b4abb1832078178886133817c5e477b31653e82c726593d8c7e3469016efdd5ac8fbe2b84ccdb9eaea134ee9992adb07398d71a83aa3546e8eac3f
SSDEEP

6144:oxcEz2rq+bhsbF7adgseHHiQwQc267/JzuSGpRhFyQ+d:oaEau+1sbF73HCQwQl67JzuD/

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1800-54-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/1800-56-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/1800-57-0x0000000000400000-0x0000000000466000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1800	0bb3a7b99e28fc4bb71c92deaf9e90fc01a8a8d97b8a708323b7ba9eef613c38.exe
1800	0bb3a7b99e28fc4bb71c92deaf9e90fc01a8a8d97b8a708323b7ba9eef613c38.exe

C:\Users\Admin\AppData\Local\Temp\0bb3a7b99e28fc4bb71c92deaf9e90fc01a8a8d97b8a708323b7ba9eef613c38.exe
"C:\Users\Admin\AppData\Local\Temp\0bb3a7b99e28fc4bb71c92deaf9e90fc01a8a8d97b8a708323b7ba9eef613c38.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1800

memory/1800-54-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1800-55-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download
memory/1800-56-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1800-57-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download