56c35453d8a5181af24f9e1920ef57620150821ef47fe0a3f3c60c2df9d31df3

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
23/09/2023, 01:16

Target

56c35453d8a5181af24f9e1920ef57620150821ef47fe0a3f3c60c2df9d31df3.exe
Size

12.8MB
MD5

4fd5b581358d87a4f1952cffbafd0427
SHA1

df0f92a65e9a51873aca39042c35ef1738303b07
SHA256

56c35453d8a5181af24f9e1920ef57620150821ef47fe0a3f3c60c2df9d31df3
SHA512

d0568f1b8a0520ca4383faf49d9cac0e2d5afd6cae8792cf558047fad58f9873942581a8d21d74eef3188d4fca4b47a62c4239683c27fb595c9852b21740730e
SSDEEP

24576:2AejVhWq+pT5fyd6NgoQBlEZaaYTNWwV0YGr3tBJLOqmu3yVVlieoCQy1DfHGrXM:2oq+hVZEYRYybJLOqmu3snYy1j

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2196-1-0x0000000010000000-0x0000000010018000-memory.dmp	upx
behavioral1/memory/2196-4-0x0000000010000000-0x0000000010018000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2196	56c35453d8a5181af24f9e1920ef57620150821ef47fe0a3f3c60c2df9d31df3.exe
2196	56c35453d8a5181af24f9e1920ef57620150821ef47fe0a3f3c60c2df9d31df3.exe
2196	56c35453d8a5181af24f9e1920ef57620150821ef47fe0a3f3c60c2df9d31df3.exe

C:\Users\Admin\AppData\Local\Temp\56c35453d8a5181af24f9e1920ef57620150821ef47fe0a3f3c60c2df9d31df3.exe
"C:\Users\Admin\AppData\Local\Temp\56c35453d8a5181af24f9e1920ef57620150821ef47fe0a3f3c60c2df9d31df3.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2196

memory/2196-1-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2196-3-0x0000000075AE0000-0x0000000075BF0000-memory.dmp

Filesize
1.1MB

Download
memory/2196-4-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2196-5-0x0000000075AE0000-0x0000000075BF0000-memory.dmp

Filesize
1.1MB

Download