68a116218b9e3aed24668ad0a8256a3ce0a6bd16070ec1b06677a7dd135fc5d7

Analysis

max time kernel
17s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 19:41

Target

68a116218b9e3aed24668ad0a8256a3ce0a6bd16070ec1b06677a7dd135fc5d7.exe
Size

13KB
MD5

b214bf4e1e5b19a3494de2c9c07382c9
SHA1

60f2f4968b285b9cd0732d48c18e869158a00465
SHA256

68a116218b9e3aed24668ad0a8256a3ce0a6bd16070ec1b06677a7dd135fc5d7
SHA512

7b0053db500f40f910bf1dd45253a382014dfcd93df8756e077b946a102f0d685c179a22b601a83b05c3c5e486267185cb9070f815a89ae357254199405ced12
SSDEEP

192:/TJAaqMAGKAFu84GRvg7qyAdMJXNFAW9Wv0N20pp1wEDDE0hr:/TJA3zz57qXdMVNZ9WvSBH1Z/E0hr

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1628-56-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1628-57-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

68a116218b9e3aed24668ad0a8256a3ce0a6bd16070ec1b06677a7dd135fc5d7.exe

pid process

1628 68a116218b9e3aed24668ad0a8256a3ce0a6bd16070ec1b06677a7dd135fc5d7.exe

pid	process
1628	68a116218b9e3aed24668ad0a8256a3ce0a6bd16070ec1b06677a7dd135fc5d7.exe

C:\Users\Admin\AppData\Local\Temp\68a116218b9e3aed24668ad0a8256a3ce0a6bd16070ec1b06677a7dd135fc5d7.exe
"C:\Users\Admin\AppData\Local\Temp\68a116218b9e3aed24668ad0a8256a3ce0a6bd16070ec1b06677a7dd135fc5d7.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1628

memory/1628-56-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1628-57-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download