407609987345550c854fc2bb8694d959db0acb3bf80a8f48a4f9dbd3b5082787

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20-03-2023 07:55

Target

407609987345550c854fc2bb8694d959db0acb3bf80a8f48a4f9dbd3b5082787.exe
Size

799KB
MD5

c04cffdd613836cfda55f03354bc3a3a
SHA1

3d07ceed5eef68fa51448d8823a44715f66c9b33
SHA256

407609987345550c854fc2bb8694d959db0acb3bf80a8f48a4f9dbd3b5082787
SHA512

b68b0fe81cb127ca5692b271df87bccdb713c8602b588c6add59333278eb65b13f677cec6a34fb9523e078c76fcfec872823ee08969881d13d35838575fa5b41
SSDEEP

24576:mGxh9QGOacIfOu1RE/os2yrA6nJuhh+0:m7GC0Ou8/RLrbnJuhhX

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1060-54-0x0000000010000000-0x000000001001E000-memory.dmp	upx
behavioral1/memory/1060-55-0x0000000000780000-0x000000000078B000-memory.dmp	upx
behavioral1/memory/1060-57-0x0000000010000000-0x000000001001E000-memory.dmp	upx
behavioral1/memory/1060-58-0x0000000000780000-0x000000000078B000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

407609987345550c854fc2bb8694d959db0acb3bf80a8f48a4f9dbd3b5082787.exe

pid	process
1060	407609987345550c854fc2bb8694d959db0acb3bf80a8f48a4f9dbd3b5082787.exe
1060	407609987345550c854fc2bb8694d959db0acb3bf80a8f48a4f9dbd3b5082787.exe

C:\Users\Admin\AppData\Local\Temp\407609987345550c854fc2bb8694d959db0acb3bf80a8f48a4f9dbd3b5082787.exe
"C:\Users\Admin\AppData\Local\Temp\407609987345550c854fc2bb8694d959db0acb3bf80a8f48a4f9dbd3b5082787.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1060

memory/1060-54-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1060-55-0x0000000000780000-0x000000000078B000-memory.dmp

Filesize
44KB

Download
memory/1060-56-0x0000000000400000-0x00000000005ED000-memory.dmp

Filesize
1.9MB

Download
memory/1060-57-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1060-58-0x0000000000780000-0x000000000078B000-memory.dmp

Filesize
44KB

Download
memory/1060-59-0x0000000000400000-0x00000000005ED000-memory.dmp

Filesize
1.9MB

Download