b4995a42f913c93412364b5413084964f4791b11a853e260e594f8678e8f145c

Analysis

max time kernel
166s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 07:43

Target

b4995a42f913c93412364b5413084964f4791b11a853e260e594f8678e8f145c.exe
Size

1.6MB
MD5

390f7b3a71a35a5a8c1dcb07917e8a2d
SHA1

d5c3e3375a12f125f389dddae9e88783f1e22edd
SHA256

b4995a42f913c93412364b5413084964f4791b11a853e260e594f8678e8f145c
SHA512

b0f131ac5f8b22149c967a199c7d3748b2bf4887d886504547d451d51e2d778fd3d6b1018d5382e61b5fd771594242a9a0a163fac4556992f0e5899a3c1dd71c
SSDEEP

49152:PuypTq5TkaTZaqdwk0c05HGigchXiB9dH:GgTqZkaYqdwkLcHHU

Score

9^/10

upx

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\SkinH_EL.dll	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\SkinH_EL.dll	upx
behavioral2/memory/4940-133-0x0000000010000000-0x000000001003D000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

b4995a42f913c93412364b5413084964f4791b11a853e260e594f8678e8f145c.exe

pid process

4940 b4995a42f913c93412364b5413084964f4791b11a853e260e594f8678e8f145c.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

b4995a42f913c93412364b5413084964f4791b11a853e260e594f8678e8f145c.exe

C:\Users\Admin\AppData\Local\Temp\SkinH_EL.dll

Filesize
86KB

MD5
147127382e001f495d1842ee7a9e7912

SHA1
92d1ed56032183c75d4b57d7ce30b1c4ae11dc9b

SHA256
edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc

SHA512
97f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d

Download Submit
memory/4940-133-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download