fad398fd1100f4afa63068f3d41a7c9be46102b9229c8e43ea6335ad59ac55fb

Resubmissions

23/03/2025, 10:00

23/03/2025, 09:50

max time kernel
92s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
23/03/2025, 10:00

Target

R.E.P.O.v0.1.2-OFME.rar
Size

386.1MB
MD5

3272e8d6f9d92fdf583f26b047cd823c
SHA1

b539a3e69b8d92b2c48c935f3051ab4b68b3aa34
SHA256

fad398fd1100f4afa63068f3d41a7c9be46102b9229c8e43ea6335ad59ac55fb
SHA512

364c8d38f5d1b8323eb1bdc3d8548ca2630493e7982a9db6e75c21994979d9adeaba8575c114a78e9fc33d9738177f06c08bc534db27e4e3dd9d5491e334e0d7
SSDEEP

6291456:+WVq8Q31asIx4D31VWJTvRMmo5+YgdQAOYUazMVhJ34kYnsWD:rVkafyDoT5LYgwYehJ3lYnsWD

Score

7^/10

Executes dropped EXE 4 IoCs

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5456	7zFM.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Suspicious use of FindShellTrayWindow 7 IoCs

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5456 wrote to memory of 2760	5456	7zFM.exe	84
PID 5456 wrote to memory of 2760	5456	7zFM.exe	84
PID 5456 wrote to memory of 4580	5456	7zFM.exe	87
PID 5456 wrote to memory of 4580	5456	7zFM.exe	87
PID 5456 wrote to memory of 4084	5456	7zFM.exe	88
PID 5456 wrote to memory of 4084	5456	7zFM.exe	88
PID 5456 wrote to memory of 3804	5456	7zFM.exe	89
PID 5456 wrote to memory of 3804	5456	7zFM.exe	89

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\R.E.P.O.v0.1.2-OFME.rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5456
- C:\Users\Admin\AppData\Local\Temp\7zO0559CE18\REPO.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0559CE18\REPO.exe"
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Users\Admin\AppData\Local\Temp\7zO055C6098\REPO.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO055C6098\REPO.exe"
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Users\Admin\AppData\Local\Temp\7zO055CF0A8\REPO.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO055CF0A8\REPO.exe"
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Users\Admin\AppData\Local\Temp\7zO055A26C8\REPO.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO055A26C8\REPO.exe"
  2⤵
  - Executes dropped EXE
  PID:3804

C:\Users\Admin\AppData\Local\Temp\7zO0559CE18\REPO.exe

Filesize
651KB

MD5
37e2e7e012343ccef500133286fcbf27

SHA1
4b7e66039d04b14ddcfb580a6e6a395ea52222be

SHA256
1643ff9ed131adde7a22363f26d36308b4b4fb8f9ba61e5afce3b6803c5cb302

SHA512
418dcb69e506f42248c00459eb3fa5a576006fead83cb5372e5710a8e95265654c316bbb314e4b8afa69e393a7cdf01219b7e17095d1990ab418f0aed68c687e

Download Submit