9eef6e2d4e5d2511a3fb86645bc5ae5d239a58da5b5650470a5deece1c731668

Analysis

max time kernel
60s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 21:22

Target

傳奇守護者免费版1.8.9/detection/passpk.exe
Size

544KB
MD5

836123d9e6e86b89913ad2c55cb73005
SHA1

13368c2e7470fc1d6c10139350ba9874577f7e90
SHA256

60c5543fd6055bd2a48528a726a27881d20a73fb3a32ec2118f4b559e62b6c24
SHA512

1a350134d5e0c35696d897600c381317ed1b9750ff1bb0a8e72a2d8f0ceb4e6861115d2ac08f107da834120587a82774675ad08e18f5f1a362f66926dd462aef
SSDEEP

6144:s9yqudfCdkFDDwOZmzeLV24vjBY8yc6wwpg72hlq6zCJqF/2NSMH/:zq1+/wOZcxsSSWp8gkrq1

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

passpk.exe

pid process

1512 passpk.exe
1512 passpk.exe

pid	process
1512	passpk.exe
1512	passpk.exe

C:\Users\Admin\AppData\Local\Temp\傳奇守護者免费版1.8.9\detection\passpk.exe
"C:\Users\Admin\AppData\Local\Temp\傳奇守護者免费版1.8.9\detection\passpk.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1512

memory/1512-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download