51f88806eb56e2cbd527c3ecd484f575aad9a3daf4bf1c8543274e5c93096d11

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 04:03

Target
YQArch_big5/sys/donate.chm
Size 97KB
Sample261113-emb2vszw2k
SHA256 51f88806eb56e2cbd527c3ecd484f575aad9a3daf4bf1c8543274e5c93096d11
MD5 ceb906780bd3e0e04c4af21dbc272618
SHA1 a73185fd4ede484456fff2d92b011d33196692cb
SHA512 13c146e78a8f551e52122474368621a670f9414ce2e250e64056a911c491c32eae7b69c89770f74689a4616aefeeeec1e154f9f23aaff490d8c06b05976df539
SSDEEP 3072:xyZQjgWA9O7C++ZSY9hKQs6TDYs1+cACtaIYz4qx:xyGjPA0W++aeQAq48
TLSH
T19BA3021962FFD369C37D0972AA0F7682E3E2AE2211151FFA1BC1573E1DBC409DB64660
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2572	hh.exe
2572	hh.exe

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\YQArch_big5\sys\donate.chm
1⤵
- Suspicious use of SetWindowsHookEx
PID:2572

hh.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\HTML Help\hh.dat
Size 8KB
SHA256 3549680e2f08a6eeff6ea8eb9dd7fecee38fd44efe2de4a2dbd82709cc88626b
MD5 029dd221b0ca736da7fa4298d3da7d58
SHA1 59738940ee7397023c6c3b16e1932f713249461e
SHA512 8d11cb3da33ef5cb604ad8b628827cd8786681da6b7ca6c0a3011f4e7bb10e419660e271ea5fc4e6641d37c2dbd2b187870103a92af1081945a5eae7b52502f3
SSDEEP 12:xgm6ysNMqiNMvyc0Ke0l6eohI+KKe+KjK9zh+KlE/KlEvt+KlEvdX:xOx5yc0JQ1V2FlEClEvt1lEvdX
TLSH
T10902493072208120E00D8B37BFDA959B75257D42AE94551B300EF75E45B9E0E5BB05EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download