f0bc18db72ef6a1031458b27b7bdb532e2745136c7340f1ed445ccc4d736c9f6 | Triage

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 20:47

Sharing

Report Analysis Logs

General

Target

f713ab2c44a9aa926ff56d5fa173f643.exe
Size

206KB
MD5

f713ab2c44a9aa926ff56d5fa173f643
SHA1

87ad36bf53e805275377ce5f88be9155c3846a3e
SHA256

f0bc18db72ef6a1031458b27b7bdb532e2745136c7340f1ed445ccc4d736c9f6
SHA512

c892dcf728a88006b9e36e505ce58f1562c85c0ae16a7fc8e2b68d7a491fe73b90ae0629d72c14c23d0769788303ea13de0db84e44d94a68273d9928694f93c8
SSDEEP

6144:EepLsFH0n+2IC5qc64bYA2VJbCYO1ho3C:EQgzZqN640Ac4loS

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2872-0-0x0000000000400000-0x0000000000647000-memory.dmp	upx
behavioral1/memory/2872-1-0x0000000000400000-0x0000000000647000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2872	f713ab2c44a9aa926ff56d5fa173f643.exe
2872	f713ab2c44a9aa926ff56d5fa173f643.exe
2872	f713ab2c44a9aa926ff56d5fa173f643.exe
2872	f713ab2c44a9aa926ff56d5fa173f643.exe

C:\Users\Admin\AppData\Local\Temp\f713ab2c44a9aa926ff56d5fa173f643.exe
"C:\Users\Admin\AppData\Local\Temp\f713ab2c44a9aa926ff56d5fa173f643.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2872-0-0x0000000000400000-0x0000000000647000-memory.dmp

Filesize
2.3MB

Download
memory/2872-1-0x0000000000400000-0x0000000000647000-memory.dmp

Filesize
2.3MB

Download