6a8147aa385a5bb2d97c3d0e75596ab707ca8609a7d4983c11f2394c7f451a8f

Analysis

max time kernel
139s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
31-08-2023 21:30

Target

6a8147aa385a5bb2d97c3d0e75596ab707ca8609a7d4983c11f2394c7f451a8f.exe
Size

6.0MB
MD5

df6d946d2eed22d95d81bd2d49e232d7
SHA1

76759b3341b8b8ca08d04131aa0e2f1e5d58e426
SHA256

6a8147aa385a5bb2d97c3d0e75596ab707ca8609a7d4983c11f2394c7f451a8f
SHA512

1f3ff35ce880c387222b7c46912bbd8125241e0569d818fdbbfa9fdb6714c8318d9e4398f27234411ff4554a59b9bd62d1396bf3679cdc5810ed8d336f3775a6
SSDEEP

98304:DhVOYRYybVGu3s5y1BKx2gYsC5IMuXmtr/+97GdX4T:DhxRPAu3s5CKl0uMMmVGq

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4592-1-0x0000000010000000-0x0000000010018000-memory.dmp	upx
behavioral2/memory/4592-5-0x0000000010000000-0x0000000010018000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4592	6a8147aa385a5bb2d97c3d0e75596ab707ca8609a7d4983c11f2394c7f451a8f.exe
4592	6a8147aa385a5bb2d97c3d0e75596ab707ca8609a7d4983c11f2394c7f451a8f.exe
4592	6a8147aa385a5bb2d97c3d0e75596ab707ca8609a7d4983c11f2394c7f451a8f.exe

C:\Users\Admin\AppData\Local\Temp\6a8147aa385a5bb2d97c3d0e75596ab707ca8609a7d4983c11f2394c7f451a8f.exe
"C:\Users\Admin\AppData\Local\Temp\6a8147aa385a5bb2d97c3d0e75596ab707ca8609a7d4983c11f2394c7f451a8f.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4592

memory/4592-1-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/4592-3-0x0000000075200000-0x00000000752F0000-memory.dmp

Filesize
960KB

Download
memory/4592-4-0x0000000075200000-0x00000000752F0000-memory.dmp

Filesize
960KB

Download
memory/4592-5-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/4592-6-0x0000000075200000-0x00000000752F0000-memory.dmp

Filesize
960KB

Download