cbe0e11d0e414b016cac81b2e01456f6392d20893cbbe46b9bcd144efa467785 | Triage

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 07:43

Sharing

Report Analysis Logs

General

Target

CF_sqrjyjhql_jb51/2013年最新CF刷枪软件.exe
Size

1.6MB
MD5

390f7b3a71a35a5a8c1dcb07917e8a2d
SHA1

d5c3e3375a12f125f389dddae9e88783f1e22edd
SHA256

b4995a42f913c93412364b5413084964f4791b11a853e260e594f8678e8f145c
SHA512

b0f131ac5f8b22149c967a199c7d3748b2bf4887d886504547d451d51e2d778fd3d6b1018d5382e61b5fd771594242a9a0a163fac4556992f0e5899a3c1dd71c
SSDEEP

49152:PuypTq5TkaTZaqdwk0c05HGigchXiB9dH:GgTqZkaYqdwkLcHHU

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/3036-132-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3036-133-0x0000000010000000-0x000000001003D000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

2013年最新CF刷枪软件.exe

pid process

3036 2013年最新CF刷枪软件.exe
3036 2013年最新CF刷枪软件.exe
3036 2013年最新CF刷枪软件.exe

C:\Users\Admin\AppData\Local\Temp\CF_sqrjyjhql_jb51\2013年最新CF刷枪软件.exe
"C:\Users\Admin\AppData\Local\Temp\CF_sqrjyjhql_jb51\2013年最新CF刷枪软件.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3036-132-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3036-133-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download