397ca84b707b75ff2126d629786537a4ce2cc83895dc9476587a8c84e4ff696e

Analysis

max time kernel
190s
max time network
229s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 16:38

Target

397ca84b707b75ff2126d629786537a4ce2cc83895dc9476587a8c84e4ff696e.exe
Size

5.4MB
MD5

df56177f893bd476e831ba148cb8706b
SHA1

238cd38cd4943c21c0a5d984858ff219336d00d4
SHA256

397ca84b707b75ff2126d629786537a4ce2cc83895dc9476587a8c84e4ff696e
SHA512

cd1b58d1fa783b7b20ac66690a58a197b7104a1bf16b0b6fb7abd1ee95087ad583db970475057cca455f06084ccc21b4691bdf4522aa462c135fd5da6fe94de0
SSDEEP

98304:klfEW69rw2KrbST4jy3Gjk1ySBpFeaa+gHRCHKjfm8BNW7ZkUrBMESnLhQnCUBOg:2Ej9UBfD0nBpF2DH0Sfm8B0FE6C/TRoL

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4584-132-0x0000000000400000-0x00000000009C8000-memory.dmp	upx
behavioral2/memory/4584-133-0x0000000000400000-0x00000000009C8000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

397ca84b707b75ff2126d629786537a4ce2cc83895dc9476587a8c84e4ff696e.exe

pid	process
4584	397ca84b707b75ff2126d629786537a4ce2cc83895dc9476587a8c84e4ff696e.exe
4584	397ca84b707b75ff2126d629786537a4ce2cc83895dc9476587a8c84e4ff696e.exe

C:\Users\Admin\AppData\Local\Temp\397ca84b707b75ff2126d629786537a4ce2cc83895dc9476587a8c84e4ff696e.exe
"C:\Users\Admin\AppData\Local\Temp\397ca84b707b75ff2126d629786537a4ce2cc83895dc9476587a8c84e4ff696e.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4584

memory/4584-132-0x0000000000400000-0x00000000009C8000-memory.dmp

Filesize
5.8MB

Download
memory/4584-133-0x0000000000400000-0x00000000009C8000-memory.dmp

Filesize
5.8MB

Download