Analysis
- user interaction
yes - max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 02:50
General
- Target Hollow Knight (+26) {mul0} [v1.5.12620].exe
- Size 10.0MB
- Sample260820-db2byabb23
- SHA256 659a96462bb826d4d60c1d956f51bb6833415e38de7caaa361eb8e8c582e3edc
Malware Config
Signatures
- UPX packed file 14 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hollow Knight (+26) {mul0} [v1.5.12620].exe"C:\Users\Admin\AppData\Local\Temp\Hollow Knight (+26) {mul0} [v1.5.12620].exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4520-4-0x0000000001AD0000-0x0000000001AD1000-memory.dmp
memory/4520-3-0x0000000001AD0000-0x0000000001AD1000-memory.dmp
memory/4520-2-0x0000000001AD0000-0x0000000001AD1000-memory.dmp
memory/4520-0-0x0000000001AD0000-0x0000000001AD1000-memory.dmp
memory/4520-9-0x0000000001AE0000-0x0000000001AE1000-memory.dmp
memory/4520-54-0x0000000001B40000-0x0000000001B41000-memory.dmp
memory/4520-53-0x0000000001B40000-0x0000000001B41000-memory.dmp
memory/4520-56-0x00000000002E0000-0x0000000001ACB000-memory.dmp
memory/4520-48-0x00007FFB4FE50000-0x00007FFB4FE51000-memory.dmp
memory/4520-47-0x00007FFB4FE50000-0x00007FFB4FE51000-memory.dmp
memory/4520-42-0x0000000001B30000-0x0000000001B31000-memory.dmp
memory/4520-41-0x0000000001B30000-0x0000000001B31000-memory.dmp
memory/4520-36-0x0000000001B20000-0x0000000001B21000-memory.dmp
memory/4520-68-0x00007FFB52850000-0x00007FFB52851000-memory.dmp
memory/4520-67-0x00007FFB52850000-0x00007FFB52851000-memory.dmp
memory/4520-57-0x00000000003A2000-0x00000000003A3000-memory.dmp
memory/4520-62-0x00007FFB51C10000-0x00007FFB51C11000-memory.dmp
memory/4520-61-0x00007FFB51C10000-0x00007FFB51C11000-memory.dmp
memory/4520-35-0x0000000001B20000-0x0000000001B21000-memory.dmp
memory/4520-30-0x0000000001B10000-0x0000000001B11000-memory.dmp
memory/4520-29-0x0000000001B10000-0x0000000001B11000-memory.dmp
memory/4520-24-0x0000000001B00000-0x0000000001B01000-memory.dmp
memory/4520-23-0x0000000001B00000-0x0000000001B01000-memory.dmp
memory/4520-18-0x0000000001AF0000-0x0000000001AF1000-memory.dmp
memory/4520-17-0x0000000001AF0000-0x0000000001AF1000-memory.dmp
memory/4520-16-0x0000000001AF0000-0x0000000001AF1000-memory.dmp
memory/4520-15-0x0000000001AF0000-0x0000000001AF1000-memory.dmp
memory/4520-10-0x0000000001AE0000-0x0000000001AE1000-memory.dmp
memory/4520-70-0x00000000002E0000-0x0000000001ACB000-memory.dmp
memory/4520-71-0x00000000002E0000-0x0000000001ACB000-memory.dmp
memory/4520-72-0x00000000002E0000-0x0000000001ACB000-memory.dmp
memory/4520-73-0x00000000002E0000-0x0000000001ACB000-memory.dmp
memory/4520-74-0x00000000002E0000-0x0000000001ACB000-memory.dmp
memory/4520-75-0x00000000002E0000-0x0000000001ACB000-memory.dmp
memory/4520-76-0x00000000002E0000-0x0000000001ACB000-memory.dmp
memory/4520-77-0x00000000002E0000-0x0000000001ACB000-memory.dmp
memory/4520-78-0x00000000002E0000-0x0000000001ACB000-memory.dmp
memory/4520-79-0x00000000002E0000-0x0000000001ACB000-memory.dmp
memory/4520-81-0x00000000002E0000-0x0000000001ACB000-memory.dmp
memory/4520-82-0x00000000002E0000-0x0000000001ACB000-memory.dmp
memory/4520-85-0x00000000002E0000-0x0000000001ACB000-memory.dmp