cbe0e11d0e414b016cac81b2e01456f6392d20893cbbe46b9bcd144efa467785 | Triage

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 07:43

Sharing

Report Analysis Logs

General

Target

CF_sqrjyjhql_jb51/2013年最新CF刷枪软件.exe
Size

1.6MB
MD5

390f7b3a71a35a5a8c1dcb07917e8a2d
SHA1

d5c3e3375a12f125f389dddae9e88783f1e22edd
SHA256

b4995a42f913c93412364b5413084964f4791b11a853e260e594f8678e8f145c
SHA512

b0f131ac5f8b22149c967a199c7d3748b2bf4887d886504547d451d51e2d778fd3d6b1018d5382e61b5fd771594242a9a0a163fac4556992f0e5899a3c1dd71c
SSDEEP

49152:PuypTq5TkaTZaqdwk0c05HGigchXiB9dH:GgTqZkaYqdwkLcHHU

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1512-55-0x0000000010000000-0x000000001003D000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

2013年最新CF刷枪软件.exe

pid process

1512 2013年最新CF刷枪软件.exe
1512 2013年最新CF刷枪软件.exe
1512 2013年最新CF刷枪软件.exe

C:\Users\Admin\AppData\Local\Temp\CF_sqrjyjhql_jb51\2013年最新CF刷枪软件.exe
"C:\Users\Admin\AppData\Local\Temp\CF_sqrjyjhql_jb51\2013年最新CF刷枪软件.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1512-54-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download
memory/1512-55-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download