2569c3c02c007e535773d74803faa9e5ebb3b4bb3c0eff1741c980edacccf863 | Triage

Analysis

max time kernel
152s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 06:45

Sharing

Report Analysis Logs

General

Target

bwwxyxw_gr/霸王微信营销软件.exe
Size

1.3MB
MD5

9334885d21586062eff80dbef52e1541
SHA1

564f8ec68172311ad209dfe843aa955da1959f44
SHA256

85b8428400a43fea8f27809538a04fb3ec403a2ca88ee852534d4efb7ea1b28e
SHA512

c682abf4a9a4a8e5b9cc6ae3cb6b7fd7347a9c95b36adf162ec3f555ecd6d748aaa6a248b0647ef3c3de079ab9b2a51e2ece23f4e2379589468ae58ab8f69c21
SSDEEP

24576:SJyhowCsDm/XBK6TZaqdiXSp0c02uFG6dAk3xM5:7ob/RVTZaqdwk0c05HGiM

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral10/memory/4604-132-0x0000000010000000-0x000000001003D000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4604	霸王微信营销软件.exe
4604	霸王微信营销软件.exe
4604	霸王微信营销软件.exe

C:\Users\Admin\AppData\Local\Temp\bwwxyxw_gr\霸王微信营销软件.exe
"C:\Users\Admin\AppData\Local\Temp\bwwxyxw_gr\霸王微信营销软件.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4604-132-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download