a3b6c975f91fd07904d0fc7c6e09be2b009295f1839c6674b296f3f5835bc17a

Analysis

max time kernel
24s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 16:41

Target

heroes-of-might-and-magic-3-platinum-collection-v40-russian-no-cdfixed-exe.7z
Size

924KB
MD5

8ed2a8aa55fad106edb4fe7136ec68e1
SHA1

75ba30f0a6a82adb69e3355df8bc578a60772126
SHA256

a3b6c975f91fd07904d0fc7c6e09be2b009295f1839c6674b296f3f5835bc17a
SHA512

f62af045efdb6dc84894e695336e2133d4681cb0d950297938704808d1adc823198da021f1ef9ac6835f325a248f461f90f5132ac116ccbb6522a25bd921743c
SSDEEP

24576:OuHkCZqPyxEerdBWCU0j5L/oR9iCiFwy4nA:OWZaei0aR+wy4nA

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2788	Heroes3.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3024	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3024	7zFM.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of FindShellTrayWindow 4 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2788	3024	7zFM.exe	30
PID 3024 wrote to memory of 2788	3024	7zFM.exe	30
PID 3024 wrote to memory of 2788	3024	7zFM.exe	30
PID 3024 wrote to memory of 2788	3024	7zFM.exe	30

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\heroes-of-might-and-magic-3-platinum-collection-v40-russian-no-cdfixed-exe.7z"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\7zO0DBB9B87\Heroes3.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0DBB9B87\Heroes3.exe"
  2⤵
  - Executes dropped EXE
  PID:2788

C:\Users\Admin\AppData\Local\Temp\7zO0DBB9B87\Heroes3.exe

Filesize
2.6MB

MD5
55be6a65157a1d4f6912817ad96e33c8

SHA1
a1f72226ac15d5966e70c52a829fd13b500cf31e

SHA256
3e4dcb2c0f9105b25b63dc324a440cb4d5e1ef899174c5319a3bbaad5ebe3ee6

SHA512
e28453f6d3ed9f7f2fd1630f338348cb278f9e2abb3fb649c730fdbc07bd037a38361c6ca3fea96d8826ccde105768cde765702239980cd1be496f657f3db95a

Download Submit