58de43fc39f4b70767e21d0b11091fbb9c164ac33fee5374bffa4fbc94b54de1

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/03/2025, 06:05

Target

REPO-SteamRIP.com (1).rar
Size

356.1MB
MD5

0e2f2ffb11368a49808761920c589ca2
SHA1

988e2e12c6dca8a30f12ab9ff0a013aa26fe2759
SHA256

58de43fc39f4b70767e21d0b11091fbb9c164ac33fee5374bffa4fbc94b54de1
SHA512

12d317dfa4356220b315e900e1605bb0439fc8e45a14d948d7fd45d6dcc5e31069c8e6bfb34e4023745cca15bf1bc1fe27977474dd61b93373f4bc24edcdafbb
SSDEEP

6291456:F+OmJ+KJsh82HcvufaTW6Z8QtrlxBn3soLhG0pHvcwt8zx+/+qJY5U3ykh2MtM:F+OmJJshrHN6Z8Gxh8ocYbtixfiYYlhm

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2128	REPO.exe

Loads dropped DLL 1 IoCs

pid	Process
2504	7zFM.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2504	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2504	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2504	7zFM.exe
2504	7zFM.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2128	2504	7zFM.exe	31
PID 2504 wrote to memory of 2128	2504	7zFM.exe	31
PID 2504 wrote to memory of 2128	2504	7zFM.exe	31

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\REPO-SteamRIP.com (1).rar"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Users\Admin\AppData\Local\Temp\7zO8C9A4F37\REPO.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO8C9A4F37\REPO.exe"
  2⤵
  - Executes dropped EXE
  PID:2128

\Users\Admin\AppData\Local\Temp\7zO8C9A4F37\REPO.exe

Filesize
651KB

MD5
37e2e7e012343ccef500133286fcbf27

SHA1
4b7e66039d04b14ddcfb580a6e6a395ea52222be

SHA256
1643ff9ed131adde7a22363f26d36308b4b4fb8f9ba61e5afce3b6803c5cb302

SHA512
418dcb69e506f42248c00459eb3fa5a576006fead83cb5372e5710a8e95265654c316bbb314e4b8afa69e393a7cdf01219b7e17095d1990ab418f0aed68c687e

Download Submit