1ee02c8acc56cfd36d734c77959d0cd74593d9ffb7a355b1b84a27996cfce198

Analysis

max time kernel
32s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20-03-2023 07:55

Target

1ee02c8acc56cfd36d734c77959d0cd74593d9ffb7a355b1b84a27996cfce198.exe
Size

788KB
MD5

268a9254692a2a36103ae7e5485adbea
SHA1

5d2370dbb4e39d391f68718a4c228ae7fa0440a8
SHA256

1ee02c8acc56cfd36d734c77959d0cd74593d9ffb7a355b1b84a27996cfce198
SHA512

3512f635c78f23abe51849cf7007a761be661a5367f36c2c824cd214d21a64c75cde5d2603a86384324e6952e8deff0fdaac84b018b77c9d5d227b79c3c53773
SSDEEP

24576:kfBrXG+YegGdCxWD35RE/ofTlvA/Qc5GoA:0BrWjegGdAWDo/MS/QwfA

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1308-54-0x0000000010000000-0x000000001001E000-memory.dmp	upx
behavioral1/memory/1308-55-0x0000000000240000-0x000000000024B000-memory.dmp	upx
behavioral1/memory/1308-57-0x0000000010000000-0x000000001001E000-memory.dmp	upx
behavioral1/memory/1308-58-0x0000000000240000-0x000000000024B000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

1ee02c8acc56cfd36d734c77959d0cd74593d9ffb7a355b1b84a27996cfce198.exe

pid	process
1308	1ee02c8acc56cfd36d734c77959d0cd74593d9ffb7a355b1b84a27996cfce198.exe
1308	1ee02c8acc56cfd36d734c77959d0cd74593d9ffb7a355b1b84a27996cfce198.exe

C:\Users\Admin\AppData\Local\Temp\1ee02c8acc56cfd36d734c77959d0cd74593d9ffb7a355b1b84a27996cfce198.exe
"C:\Users\Admin\AppData\Local\Temp\1ee02c8acc56cfd36d734c77959d0cd74593d9ffb7a355b1b84a27996cfce198.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1308

memory/1308-54-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1308-55-0x0000000000240000-0x000000000024B000-memory.dmp

Filesize
44KB

Download
memory/1308-57-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1308-56-0x0000000000400000-0x00000000005E7000-memory.dmp

Filesize
1.9MB

Download
memory/1308-58-0x0000000000240000-0x000000000024B000-memory.dmp

Filesize
44KB

Download
memory/1308-59-0x0000000000400000-0x00000000005E7000-memory.dmp

Filesize
1.9MB

Download