6a67d43209abf575634aaae36f4624807ace7926956e4981558cf9852419a0c7

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/10/2026, 21:30

Target
About/Teka/Help/en-US/Help/mui/0409/sqlsodbc.chm
Size 72KB
Sample261016-1cs4aaxt7j
SHA256 6a67d43209abf575634aaae36f4624807ace7926956e4981558cf9852419a0c7
MD5 ee4c26f9aed9ea6f00895ad68e6fba27
SHA1 4a36763cbd1bf495f75fe9d76ed295a21ed7ad9a
SHA512 f0e41f031936a2ba4edfb958740701e95c6917d523c488ab460ebbd34215e4b7bb73b41d0ab24f89494f1d0dcde115acbcc0c19f88675205880cfc42e59f4c20
SSDEEP 1536:VVJ8Jl74akWbn6wHScThhohCJSEzsyrVXxKBe8Yk:HJ8JGqb/S2khCWO4e8d
TLSH
T1AE73F138B972C277D749C77AA26A899BD089204FFE26E4F433D45903213CF8C6B501A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1204	hh.exe
1204	hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\About\Teka\Help\en-US\Help\mui\0409\sqlsodbc.chm
1⤵
- Suspicious use of SetWindowsHookEx
PID:1204

hh.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\HTML Help\hh.dat
Size 8KB
SHA256 f1960f350d386dbf17a71adbd85310a2afc70ec3e26d71bfc47d7b9303cf18b9
MD5 3bb3071cf8b11e03a9cc3f748e57e6bf
SHA1 737b721c0d7ae5d105b97d99ea4a4aa7588354ca
SHA512 1b08513110202ae4336f00e84071467210239b627000e959f5cd20eaa1d96debc81b2729eb66035b374e7dfa77723776114837d78b029849fda1776e2ba0af3b
SSDEEP 12:Gtm6ysNMqiNMvyc0Ke0l6eohI+KKe+KjK9zh+KlE/KlEvt+KlEvdX:GHx5yc0JQ1V2FlEClEvt1lEvdX
TLSH
T12002493072208124E00D8B37BFDA958B75247D42AE94451B300EF75E46B9E0E5BB05EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download