c5b6ff953f0afa822bdad2404759ac629efd5285099804a887eb90d976ef3053

Analysis

max time kernel
0s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 00:57

Target

e939a53fe11b0d32d9ee617f92d48fc4b409516d5c5ecfe4599a6c64d7fb1241.exe
Size

1.3MB
MD5

4dce9a0afd4a43f7a21896f50aa2b442
SHA1

f915dad6ebd4276518f7d962619a3c4612b76be0
SHA256

e939a53fe11b0d32d9ee617f92d48fc4b409516d5c5ecfe4599a6c64d7fb1241
SHA512

daf5a5e4b0601f8f0b29f8292b659be41a79d7045fe0b9ffa8b71df966aac01ef5d29bcec2be4aee233926976f8708f6bb86f4639e4ee08368ac9909bfac7290
SSDEEP

24576:lDlfF9pRxwExoc7pZtSDBPNqig4ON4+xJX7YRk:nFDRx7V7pEPHpON4qJX7V

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/2808-0-0x0000000000940000-0x0000000000D22000-memory.dmp	upx
behavioral2/memory/2808-5-0x0000000000940000-0x0000000000D22000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

e939a53fe11b0d32d9ee617f92d48fc4b409516d5c5ecfe4599a6c64d7fb1241.exe

pid	process
2808	e939a53fe11b0d32d9ee617f92d48fc4b409516d5c5ecfe4599a6c64d7fb1241.exe
2808	e939a53fe11b0d32d9ee617f92d48fc4b409516d5c5ecfe4599a6c64d7fb1241.exe
2808	e939a53fe11b0d32d9ee617f92d48fc4b409516d5c5ecfe4599a6c64d7fb1241.exe
2808	e939a53fe11b0d32d9ee617f92d48fc4b409516d5c5ecfe4599a6c64d7fb1241.exe

C:\Users\Admin\AppData\Local\Temp\e939a53fe11b0d32d9ee617f92d48fc4b409516d5c5ecfe4599a6c64d7fb1241.exe
"C:\Users\Admin\AppData\Local\Temp\e939a53fe11b0d32d9ee617f92d48fc4b409516d5c5ecfe4599a6c64d7fb1241.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2808

memory/2808-0-0x0000000000940000-0x0000000000D22000-memory.dmp

Filesize
3.9MB

Download
memory/2808-5-0x0000000000940000-0x0000000000D22000-memory.dmp

Filesize
3.9MB

Download