f0e3a7604967b28a7902c8a5db1a9e60453a65048359f97d41e2e374de6bbaab

Analysis

max time kernel
19s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26-08-2024 12:59

Target

xkowhook v2.exe
Size

10.8MB
MD5

fad1255f32bd8e586b502d6834f1965a
SHA1

459862ff8a65e2c4846a9ff4c3fff90d3b16fec2
SHA256

f0e3a7604967b28a7902c8a5db1a9e60453a65048359f97d41e2e374de6bbaab
SHA512

334ea48c00484849f86f061e954cb2af65eaea5bc65ca1bdf6ef16d86e88a9021f76cadd4993826e04b327c4d63a2e28e77e8c4fac0b68bcaf45ff1b2dc3de99
SSDEEP

196608:F5t3cANrPA4mtSHeNvX+wfm/pf+xfdkR0ZWKsnarIWOzW0DaqkH:zavvtSUvX+9/pWFGRiBsnarIWeRaDH

Score

7^/10

upx

Loads dropped DLL 1 IoCs

pid	Process
2968	xkowhook v2.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/files/0x000500000001962d-46.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2968	2696	xkowhook v2.exe	30
PID 2696 wrote to memory of 2968	2696	xkowhook v2.exe	30
PID 2696 wrote to memory of 2968	2696	xkowhook v2.exe	30

C:\Users\Admin\AppData\Local\Temp\xkowhook v2.exe
"C:\Users\Admin\AppData\Local\Temp\xkowhook v2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Users\Admin\AppData\Local\Temp\xkowhook v2.exe
  "C:\Users\Admin\AppData\Local\Temp\xkowhook v2.exe"
  2⤵
  - Loads dropped DLL
  PID:2968

C:\Users\Admin\AppData\Local\Temp\_MEI26962\python311.dll

Filesize
1.6MB

MD5
db09c9bbec6134db1766d369c339a0a1

SHA1
c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b

SHA256
b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79

SHA512
653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45

Download Submit
memory/2968-48-0x000007FEF5ED0000-0x000007FEF64B8000-memory.dmp

Filesize
5.9MB

Download