a9dc15b82fc53d59174c81e82473bd043144f1bb0255d81d1ca6974b84e50dbe

Analysis

max time kernel
25s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:26

Target

a9dc15b82fc53d59174c81e82473bd043144f1bb0255d81d1ca6974b84e50dbe.exe
Size

188KB
MD5

bf96fd9e7f16cc53619ba48cb9f3810f
SHA1

125dd077dccc9c72b0dd1ea5e19b4a77564b116e
SHA256

a9dc15b82fc53d59174c81e82473bd043144f1bb0255d81d1ca6974b84e50dbe
SHA512

792ac8b4beb88495898bc518c13c2cc69afe5e24cda9ef385ae9f0449f3aeca3264d0f68b66793d811de1f77a56f745aaeda0a686dc5c3a1a361ce02fdf021c6
SSDEEP

3072:cybX+jR7MjolU6Q7qwsheiiwXa8aY1aUI8eH2EcDwogM738q/YMnuuyfxGp1fncy:H+jR7BW6Q7OniwX3IU0HProMq00cy

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1992-54-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1992-57-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1992-58-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

a9dc15b82fc53d59174c81e82473bd043144f1bb0255d81d1ca6974b84e50dbe.exe

pid process

1992 a9dc15b82fc53d59174c81e82473bd043144f1bb0255d81d1ca6974b84e50dbe.exe

pid	process
1992	a9dc15b82fc53d59174c81e82473bd043144f1bb0255d81d1ca6974b84e50dbe.exe

C:\Users\Admin\AppData\Local\Temp\a9dc15b82fc53d59174c81e82473bd043144f1bb0255d81d1ca6974b84e50dbe.exe
"C:\Users\Admin\AppData\Local\Temp\a9dc15b82fc53d59174c81e82473bd043144f1bb0255d81d1ca6974b84e50dbe.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1992

memory/1992-54-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1992-57-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1992-58-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download