94347884ee1887e2d29e243e9136e6b63da3178daa5e5ddbcf533e8897a9e4f5

Analysis

max time kernel
233s
max time network
69s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
12-02-2023 19:05

Target

94347884ee1887e2d29e243e9136e6b63da3178daa5e5ddbcf533e8897a9e4f5.exe
Size

4.5MB
MD5

702c31ebb60e92d867c2dca14c2d59f8
SHA1

bae7d1c97bc27ffd0f59c733f306163535cfcc9b
SHA256

94347884ee1887e2d29e243e9136e6b63da3178daa5e5ddbcf533e8897a9e4f5
SHA512

3383aa196a78c04733fd103292ae6641abee3168797826c6a66bf292750929feb145f80fb68466a7f066bbfc63254b7ca7eff775013037c9e2507ed3194404e2
SSDEEP

98304:NfPIhn1jKUO7H/ZjoRPKf8MKQ2e2IVvbWEsPCLFPzLNFpsptX:NIhhKH/mR28o2I1bWEsqRPH/psX

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1112-59-0x0000000000ED0000-0x0000000000F06000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

94347884ee1887e2d29e243e9136e6b63da3178daa5e5ddbcf533e8897a9e4f5.exe

pid	process
1112	94347884ee1887e2d29e243e9136e6b63da3178daa5e5ddbcf533e8897a9e4f5.exe
1112	94347884ee1887e2d29e243e9136e6b63da3178daa5e5ddbcf533e8897a9e4f5.exe
1112	94347884ee1887e2d29e243e9136e6b63da3178daa5e5ddbcf533e8897a9e4f5.exe

C:\Users\Admin\AppData\Local\Temp\94347884ee1887e2d29e243e9136e6b63da3178daa5e5ddbcf533e8897a9e4f5.exe
"C:\Users\Admin\AppData\Local\Temp\94347884ee1887e2d29e243e9136e6b63da3178daa5e5ddbcf533e8897a9e4f5.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1112

memory/1112-54-0x0000000000400000-0x0000000000E83000-memory.dmp

Filesize
10.5MB

Download
memory/1112-55-0x0000000076581000-0x0000000076583000-memory.dmp

Filesize
8KB

Download
memory/1112-56-0x0000000000400000-0x0000000000E83000-memory.dmp

Filesize
10.5MB

Download
memory/1112-57-0x0000000000400000-0x0000000000E83000-memory.dmp

Filesize
10.5MB

Download
memory/1112-58-0x0000000000400000-0x0000000000E83000-memory.dmp

Filesize
10.5MB

Download
memory/1112-59-0x0000000000ED0000-0x0000000000F06000-memory.dmp

Filesize
216KB

Download
memory/1112-60-0x0000000000F80000-0x0000000000F93000-memory.dmp

Filesize
76KB

Download
memory/1112-61-0x0000000000400000-0x0000000000E83000-memory.dmp

Filesize
10.5MB

Download