99bec041484d53d8e6626e296320ad5f8c03b08b42cf9733c3272df4354d17b4

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
30-03-2023 05:00

Target

99bec041484d53d8e6626e296320ad5f8c03b08b42cf9733c3272df4354d17b4.exe
Size

754KB
MD5

7034c75cdbf1e78470cb7fe6ff52f8c5
SHA1

5451b2287347f854eae0f6d761c69b6bd261e493
SHA256

99bec041484d53d8e6626e296320ad5f8c03b08b42cf9733c3272df4354d17b4
SHA512

90967003e043b7f4c92556cab7e171798b423b62d2bf518b3bb6e71e109552785a4ef9131fe8ef08c94783ce24b974a4157796012d7b468f78e6a732dea02a7e
SSDEEP

12288:oWZZwaIm3dtvp4yoTNCzmBzl97NbxWlZ1x748psWa+0kSvxnB/2u9uHdGarqa9BX:jZZwu3zeyoQz+99clN48p7Z0T2bcBmBX

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/2004-54-0x00000000003D0000-0x00000000003DB000-memory.dmp	upx
behavioral1/memory/2004-56-0x00000000003D0000-0x00000000003DB000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

99bec041484d53d8e6626e296320ad5f8c03b08b42cf9733c3272df4354d17b4.exe

pid	process
2004	99bec041484d53d8e6626e296320ad5f8c03b08b42cf9733c3272df4354d17b4.exe
2004	99bec041484d53d8e6626e296320ad5f8c03b08b42cf9733c3272df4354d17b4.exe

C:\Users\Admin\AppData\Local\Temp\99bec041484d53d8e6626e296320ad5f8c03b08b42cf9733c3272df4354d17b4.exe
"C:\Users\Admin\AppData\Local\Temp\99bec041484d53d8e6626e296320ad5f8c03b08b42cf9733c3272df4354d17b4.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2004

memory/2004-54-0x00000000003D0000-0x00000000003DB000-memory.dmp

Filesize
44KB

Download
memory/2004-55-0x0000000000400000-0x00000000005B8000-memory.dmp

Filesize
1.7MB

Download
memory/2004-56-0x00000000003D0000-0x00000000003DB000-memory.dmp

Filesize
44KB

Download