66fcf9788606396a55fade52a71b9056e8bd42cfbc123591e9cc91a8f6ae5294

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 23:30

Target

66fcf9788606396a55fade52a71b9056e8bd42cfbc123591e9cc91a8f6ae5294.exe
Size

279KB
MD5

0f27fafed768dd0c0ad11e124051b1ed
SHA1

a0481f07b819ff06ba0185e46881c6ea68b04db1
SHA256

66fcf9788606396a55fade52a71b9056e8bd42cfbc123591e9cc91a8f6ae5294
SHA512

92104779ddfe96a06ebcd8b6b2ddc321f413fa42790bef53b8aa9cf18898271a04ae288cca05331054147730f3d299dc9e1242dcde11d388f7bcfaf55a55c8a1
SSDEEP

6144:xE3aIJRwD48TuCbd2i+Giz+6JCq0/vLPjW3XxwH1uZCFoSRdCv:xYF2Jn2m6JCq0nLr+uViCFoSjCv

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1492-55-0x0000000000400000-0x00000000004C2000-memory.dmp	upx
behavioral1/memory/1492-56-0x0000000000400000-0x00000000004C2000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1492	66fcf9788606396a55fade52a71b9056e8bd42cfbc123591e9cc91a8f6ae5294.exe
1492	66fcf9788606396a55fade52a71b9056e8bd42cfbc123591e9cc91a8f6ae5294.exe

C:\Users\Admin\AppData\Local\Temp\66fcf9788606396a55fade52a71b9056e8bd42cfbc123591e9cc91a8f6ae5294.exe
"C:\Users\Admin\AppData\Local\Temp\66fcf9788606396a55fade52a71b9056e8bd42cfbc123591e9cc91a8f6ae5294.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1492

memory/1492-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1492-55-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1492-56-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download