5098e4a3491fb404fae5fe93409fbe8cae2f42d7e87285ae6aed82bca02344c6

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 20:55

Target

f793dd171120fbe0fa04edb8f24327ae.exe
Size

60KB
MD5

f793dd171120fbe0fa04edb8f24327ae
SHA1

4dc8247727b83ab142cd696728e8e0f79587227a
SHA256

5098e4a3491fb404fae5fe93409fbe8cae2f42d7e87285ae6aed82bca02344c6
SHA512

75b73db332961021ae8c6b41530345b73c6a9dafd3cba017dd77d72a6a553d710ceefeaf289db33f4e9a80be6abc4117872e7508293284fca570fc1e9e9ab7c1
SSDEEP

768:LM65M2OTBt1xxPS/ibZLlmN5+930GNEhLbizna+Z9L6nkPBQuZFcYH5w:hM2Obxq/N5+930baa+rLPyuZFcAw

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1964-0-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/1964-1-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1964	f793dd171120fbe0fa04edb8f24327ae.exe
1964	f793dd171120fbe0fa04edb8f24327ae.exe

C:\Users\Admin\AppData\Local\Temp\f793dd171120fbe0fa04edb8f24327ae.exe
"C:\Users\Admin\AppData\Local\Temp\f793dd171120fbe0fa04edb8f24327ae.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1964

memory/1964-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1964-1-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download