8e0e38ed2f8c46569c0b1d250f3e66b190d256a7fa0824bd5d3e8bf215fb5ce2

Analysis

max time kernel
96s
max time network
117s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 22:24

Target

rxbaoV3.29_Y/Updater.exe
Size

20KB
MD5

6128afe828136935963bd4c50cb2d2d9
SHA1

5419540d3060398c13b5913825f31951e5a9e9cc
SHA256

9342dd6979bc829e21f3689866ba928a19a73a30a16317a6334acf0fe91ba4aa
SHA512

acbbe760e960fd41068056a20cc301791fa3dc4e4a9aa7b2f0a3e7405859ebdc908e046db9c93eaeb39a2bff677513b5ec8eaf7a98f5cf902fba1e1b2d220f59
SSDEEP

384:Xqh+1RjnJviUXlxHgyXVXtfwMw7QPSYOz1+hETv6AkZVfXmmsnDNBTmYYjZL7xOC:OiRR1xHjl9fwMw7QKYOYETyAOVf2msno

Score

1^/10

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

Updater.exe

pid process

1108 Updater.exe
1108 Updater.exe
1108 Updater.exe
1108 Updater.exe
1108 Updater.exe

C:\Users\Admin\AppData\Local\Temp\rxbaoV3.29_Y\Updater.exe
"C:\Users\Admin\AppData\Local\Temp\rxbaoV3.29_Y\Updater.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1108

memory/1108-54-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download
memory/1108-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1108-56-0x0000000000020000-0x0000000000029000-memory.dmp

Filesize
36KB

Download
memory/1108-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1108-58-0x0000000000020000-0x0000000000029000-memory.dmp

Filesize
36KB

Download