3a14c783fb9bc53d2dbb1e424b1cdc4c815c98f194f72ab84d07824b249bb9ea | Triage

Analysis

max time kernel
55s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ļ޸/KLD_ļ޸.exe
Size

310KB
MD5

27919ad98c77507520bfe8e0d8997fe2
SHA1

cace9886dceac2eead1874c59247df0af65e974d
SHA256

53c95c72c65416699daa45e7399c67ddbc8c6c340e4f9f9179f3c1692ef26f2f
SHA512

8a6ab6e71527f8e6b7a261c0661f46bd3494fbdcc60b3150b5dfa3e8672e7a56ace9a369be0eef0af54a527a085d820962686bca845fa079fff049b960b96ea4
SSDEEP

6144:nnXv/RouWKhZ32eTsELh8nWoTL0KYmCh3VuPhTAOpM/:nnf5XZdZ+X

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1092-55-0x0000000000400000-0x00000000004DE000-memory.dmp	upx
behavioral1/memory/1092-56-0x0000000000400000-0x00000000004DE000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1092	KLD_ļ޸.exe
1092	KLD_ļ޸.exe

C:\Users\Admin\AppData\Local\Temp\ļ޸\KLD_ļ޸.exe
"C:\Users\Admin\AppData\Local\Temp\ļ޸\KLD_ļ޸.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1092-54-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/1092-55-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/1092-56-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download