1e9135119e36b499f8060541b5f1599378d6d5cb10d450c237b67c48d7287579

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21-03-2023 01:35

Target

1e9135119e36b499f8060541b5f1599378d6d5cb10d450c237b67c48d7287579.exe
Size

796KB
MD5

7c9090ab368c34223822f346f122d102
SHA1

c27bff4a8779332bcaed1e655885791c646fcf83
SHA256

1e9135119e36b499f8060541b5f1599378d6d5cb10d450c237b67c48d7287579
SHA512

8201b2306fdda970a03953a9b86657557796cb73ebe021515b4aff39c55bb16edc83359bae59f57a7c582f0c825ef4b05562f0e1c3d7124a552f499eaf3ee7be
SSDEEP

24576:zatJkvzmhQZfvOxS4jdDuLmeuQV/yaoMZq740i:zankgmvz4pVXM/yaoMIM0

Score

7^/10

upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1368-54-0x0000000010000000-0x000000001001E000-memory.dmp	upx
behavioral1/memory/1368-55-0x00000000002D0000-0x00000000002DB000-memory.dmp	upx
behavioral1/memory/1368-57-0x0000000010000000-0x000000001001E000-memory.dmp	upx
behavioral1/memory/1368-58-0x00000000002D0000-0x00000000002DB000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

1e9135119e36b499f8060541b5f1599378d6d5cb10d450c237b67c48d7287579.exe

pid	process
1368	1e9135119e36b499f8060541b5f1599378d6d5cb10d450c237b67c48d7287579.exe
1368	1e9135119e36b499f8060541b5f1599378d6d5cb10d450c237b67c48d7287579.exe

C:\Users\Admin\AppData\Local\Temp\1e9135119e36b499f8060541b5f1599378d6d5cb10d450c237b67c48d7287579.exe
"C:\Users\Admin\AppData\Local\Temp\1e9135119e36b499f8060541b5f1599378d6d5cb10d450c237b67c48d7287579.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1368

memory/1368-54-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1368-55-0x00000000002D0000-0x00000000002DB000-memory.dmp

Filesize
44KB

Download
memory/1368-56-0x0000000000400000-0x00000000005EB000-memory.dmp

Filesize
1.9MB

Download
memory/1368-57-0x0000000010000000-0x000000001001E000-memory.dmp

Filesize
120KB

Download
memory/1368-58-0x00000000002D0000-0x00000000002DB000-memory.dmp

Filesize
44KB

Download
memory/1368-59-0x0000000000400000-0x00000000005EB000-memory.dmp

Filesize
1.9MB

Download