645e274fec3723d065308f9b16b33392ed7f51fbd5ffc3c00806c2efafb08b65

Analysis

max time kernel
91s
max time network
103s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
22/12/2024, 14:30

Target
Autorisoft.zip
Size 17.9MB
Sample241222-rvd8ea1per
SHA256 645e274fec3723d065308f9b16b33392ed7f51fbd5ffc3c00806c2efafb08b65
MD5 5b879f39e57139ab17300879afa61554
SHA1 a18eab8e257c611f72ea92833584fff0ffaea1f2
SHA512 54814430828c204a8b606c000e2efc1fb2586f41c322ebae44d9eba4d297db473d37b520fac02c1bf88407a8a9138a3e7de502e27e32745cd4c96d54c9994ac0
SSDEEP 393216:ZE8wps0kxrkXICtuuL8qgk/H0uxE14p4RToEXkk6hFFh:m2BxoXI6gk/H0u/p4nXkke5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3712	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3712	7zFM.exe
Token: 35	3712	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3712	7zFM.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:4020