d54780bf22e747ec74bc4d093aeaba357258d15fa805a398b4d2571e3e341b65

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 04:03

Target
YQArch_big5/sys/yqhelp.chm
Size 2.9MB
Sample261113-emb2vszw2k
SHA256 d54780bf22e747ec74bc4d093aeaba357258d15fa805a398b4d2571e3e341b65
MD5 316614277f5a6476cd9f781054e9a967
SHA1 425d5dcc09d5182544589b65a921ef6a98a5154d
SHA512 c1397d28db457e03a3f4dfec246891b2afed1f7dbad9e7ae172bd5981eaf9dbed6664d331d5680139283ee33da34d3820b4e2293991cb9a11d07999c753aa871
SSDEEP 49152:kNFvVVOGeRlRZ8BDFfaauDpVqJgfC1XqBIGcnTjl+QfGCXRP6m6JW9X73Xcqyu4G:w3Uvv8hQaYfC1XqWR/uKb6Q9X73sn59m
TLSH
T134E53316C8C29CF6CAC49CBBB8F1D06EF97E7698B13B80EC40B4599D176339C0579626
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3716	hh.exe
3716	hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\YQArch_big5\sys\yqhelp.chm
1⤵
- Suspicious use of SetWindowsHookEx
PID:3716

hh.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\HTML Help\hh.dat
Size 8KB
SHA256 14da2d43fde24ef9d4c23df7ae923756961d294f530a672c6b7305cd24011aef
MD5 9e413f9144064356f14e18bd21d38c65
SHA1 0d69834aff07d780b1a172a9e4df106d8f985d95
SHA512 de85a495e2713dec6c4f73729bc640e07c578d1183d93ec0a086f26427a2660c9fda7dd5667d2dc5519a53e143da0ddcc36088461126f0a79e4211226ea26712
SSDEEP 12:zIm6ysNMqiNMvyc0Ke0l6eohI+KKe+KjK9zh+KlE/KlEvt+KlEvdX:Kx5yc0JQ1V2FlEClEvt1lEvdX
TLSH
T15A026D3073208120E00D8B37FFDA958B75247D42AE94451B300EF75E55B9E0E5BB05EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download