0455ed6abd6758907267ba9e09155bc8b1f430e2b60a33c1e1aaebf92471a32e

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20250610-en
resource tags

arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
submitted
10/09/2025, 17:56

Target
xiangrikui.exe
Size 69.4MB
Sample250910-wh5baasvcw
SHA256 b1154374d1293b990af7d3ff3524d98522639e13e37a2d4f705b52695e51cf37
MD5 ec3da6610314644fa3a99a8cb86841e6
SHA1 c21ab13a0b8d0805d99276274971d028cbb8c709
SHA512 c3b20cc9a4e7baab88a2284b5aac008cd5bdb7d978251ce2d4bb66fd2125c9cce60e79ffc5d3f81749eca85fcb9edb8fe6d081c891aa60baec895940a42ff6df
SSDEEP 1572864:+39tEJ1PII152TxP1WOd1ud6M+H0vGvZwJUpPTKsn2c5k78rZ/+nu8imFWg2HQxT:o96J1AIr2t9dY6MH+q6Jms/rZWnuiFWy
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral7/memory/3584-1-0x00007FF6E63F0000-0x00007FF6E73F0000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5484	xiangrikui.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 5484	3584	xiangrikui.exe	83
PID 3584 wrote to memory of 5484	3584	xiangrikui.exe	83

C:\Users\Admin\AppData\Local\Temp\xiangrikui.exe
"C:\Users\Admin\AppData\Local\Temp\xiangrikui.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Users\Admin\AppData\Local\Temp\xiangrikui.exe
  "C:\Users\Admin\AppData\Local\Temp\xiangrikui.exe" --mod=install --admin=1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5484

check_sign_test.log

Path C:\Users\Admin\AppData\Local\Temp\check_sign_test.log
Size 276B
SHA256 129bddfecd044679ae4324507b0af784a56dbf8334e939c2b8bcddf35c718d7b
MD5 974271e5f46e94f402ceee2122365cdc
SHA1 751a76bcf17b34d69beb77dea084f1bad899fef2
SHA512 b98cb877c3837e255db4c7f6ff6d1df87a1976bc519ed9a74e7122760e3c9521a232d2b6c5d78ff0ffe55438e503ba523246faf975da60c9a3dd525e68416ea5
MD5 SHA1 SHA512

Submit Download

memory/3584-1-0x00007FF6E63F0000-0x00007FF6E73F0000-memory.dmp

Download