2307c4119e4aba798b67546b161a41fabb05a79e0ba96b09b5bd48cdb012eb1c

Analysis

max time kernel
98s
max time network
141s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
03-01-2025 08:55

Target

$PLUGINSDIR/app-64.7z
Size

86.4MB
MD5

97696ecaf41621c8640b585135cc1a2e
SHA1

86b5058e3dc730dff769180954f7aace8f13be99
SHA256

beb3ecdf9857fda612cbb9008516e633c61e7b89ccecdc0102109c007ffb257b
SHA512

893a915c25c13bd159cfca6bf9ab75029f31b88561c571ea979e58c40d427f02a0763aa99cba31c896ec1b67cecb32936aa318c9d56fd7c35c8899c5be113247
SSDEEP

1572864:Ee4hd5gG8x/keCUDXbbJurhNih/PFM+BXfFDLXM5tG5R5mQD8vO/:Ee4DhCXHJ5XLX9gY8vu

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1748	DesktopWaifu.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3136	7zFM.exe
3136	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3136	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3136	7zFM.exe
3136	7zFM.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 1748	3136	7zFM.exe	91
PID 3136 wrote to memory of 1748	3136	7zFM.exe	91

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Users\Admin\AppData\Local\Temp\7zO04C13668\DesktopWaifu.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO04C13668\DesktopWaifu.exe"
  2⤵
  - Executes dropped EXE
  PID:1748