f0e6ff17ad8dbc2b52fb3b11d86512f605f332b946c0804a712561af8f78327a

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 15:36

Target

f0e6ff17ad8dbc2b52fb3b11d86512f605f332b946c0804a712561af8f78327a.exe
Size

587KB
MD5

079a169f2d6bd0ae509e83799c2951f5
SHA1

48abdd0adcbc39b30d3458c00785d06e86584328
SHA256

f0e6ff17ad8dbc2b52fb3b11d86512f605f332b946c0804a712561af8f78327a
SHA512

c57e2c1dbfd7304357031eba536bde6b748522a63989a755ed922b41df807d8a8611dd07acbf1a0d26dcaae11c1b3704c334f72a63da6767abf776a82f9de535
SSDEEP

6144:tXktUAQPyNHQP+XQB3uQ5aKjFRLJOvPCQhTdxnS30UPj:tXkK7yw+Q5aWHLJOHtnW0UPj

Score

8^/10

dave

Dave packer 1 IoCs

Detects executable using a packer named 'Dave' by the community, based on a string at the end.

Processes:

resource	yara_rule
behavioral2/memory/956-141-0x00000000024A0000-0x00000000024CD000-memory.dmp	dave

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

f0e6ff17ad8dbc2b52fb3b11d86512f605f332b946c0804a712561af8f78327a.exe

pid	process
956	f0e6ff17ad8dbc2b52fb3b11d86512f605f332b946c0804a712561af8f78327a.exe
956	f0e6ff17ad8dbc2b52fb3b11d86512f605f332b946c0804a712561af8f78327a.exe

C:\Users\Admin\AppData\Local\Temp\f0e6ff17ad8dbc2b52fb3b11d86512f605f332b946c0804a712561af8f78327a.exe
"C:\Users\Admin\AppData\Local\Temp\f0e6ff17ad8dbc2b52fb3b11d86512f605f332b946c0804a712561af8f78327a.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:956

memory/956-132-0x00000000024E0000-0x000000000250F000-memory.dmp

Filesize
188KB

Download
memory/956-136-0x0000000002510000-0x000000000253E000-memory.dmp

Filesize
184KB

Download
memory/956-141-0x00000000024A0000-0x00000000024CD000-memory.dmp

Filesize
180KB

Download