f22dafa37a4385c7b2281243e561548749f396f8bad0a796ed19f7b10f55542f

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21-03-2023 01:35

Target

f22dafa37a4385c7b2281243e561548749f396f8bad0a796ed19f7b10f55542f.exe
Size

789KB
MD5

d03bfb3fb8b5bda03c21a5e61aec3ad4
SHA1

444767e2291c31edf784c0b31ea0b81b6a9bf1ed
SHA256

f22dafa37a4385c7b2281243e561548749f396f8bad0a796ed19f7b10f55542f
SHA512

5671fe27409b62080aa1159b06cdfefcafd697726020c1fac1b50496200f55c36570c28fa4ef6cc5f2b0f66b799dac870456ce1a58ff932755ecb4a8a38e342c
SSDEEP

24576:byQ7kkKkASH/juLmeuQV/yaoMZq7JdvG:DIkhASH/1XM/yaoMIy

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1308-55-0x0000000000250000-0x000000000025B000-memory.dmp	upx
behavioral1/memory/1308-54-0x0000000010000000-0x000000001001E000-memory.dmp	upx
behavioral1/memory/1308-57-0x0000000010000000-0x000000001001E000-memory.dmp	upx
behavioral1/memory/1308-58-0x0000000000250000-0x000000000025B000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

f22dafa37a4385c7b2281243e561548749f396f8bad0a796ed19f7b10f55542f.exe

pid	process
1308	f22dafa37a4385c7b2281243e561548749f396f8bad0a796ed19f7b10f55542f.exe
1308	f22dafa37a4385c7b2281243e561548749f396f8bad0a796ed19f7b10f55542f.exe

C:\Users\Admin\AppData\Local\Temp\f22dafa37a4385c7b2281243e561548749f396f8bad0a796ed19f7b10f55542f.exe
"C:\Users\Admin\AppData\Local\Temp\f22dafa37a4385c7b2281243e561548749f396f8bad0a796ed19f7b10f55542f.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1308

memory/1308-55-0x0000000000250000-0x000000000025B000-memory.dmp

Filesize
44KB

Download
memory/1308-54-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1308-56-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download
memory/1308-57-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1308-58-0x0000000000250000-0x000000000025B000-memory.dmp

Filesize
44KB

Download
memory/1308-59-0x0000000000400000-0x00000000005E8000-memory.dmp

Filesize
1.9MB

Download