2ed59c0252a895b535d5eba521c3c64e722152aa67f52e931ba97b3c10114360

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 05:48

Target
OpenIV.rar
Size 1.1MB
Sample260423-ghrb4act4w
SHA256 2ed59c0252a895b535d5eba521c3c64e722152aa67f52e931ba97b3c10114360
MD5 8fc1de54fbe78f8e0c5657c44911f412
SHA1 7fb02fdf16df98f5788cbb8bd59441308e385bbd
SHA512 a75a58248ce564e5991d88794cef8e44cc2fa34e4c0e84358da00bd3b95ab8ac67c45c250dc9b0936b89c012a478aa1e420827c94edb495716658b8d99cc2538
SSDEEP 24576:/5itg6DSlkQjbOBnx0Xa3eN90+T33AMmB7UvBmG7js5e16FqMI07Evb:ZxkUOBnx0XaQHnAMYUvBmGHs5QdMIKEz
TLSH
T1614533D71B41EFF209789907AFE1C214B8EA43DBBA1D0CEAC0EABC85615613357935D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1572	OpenIV.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4056	7zFM.exe
4056	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4056	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4056	7zFM.exe
4056	7zFM.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 1572	4056	7zFM.exe	87

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\OpenIV.rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Users\Admin\AppData\Local\Temp\7zO8DFC58C7\OpenIV.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO8DFC58C7\OpenIV.exe"
  2⤵
  - Executes dropped EXE
  PID:1572

OpenIV.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO8DFC58C7\OpenIV.exe
Size 2.0MB
SHA256 5e1d1b665edbb1d073a3b10e22ef15258596cd6a8a1caf27b08084b8f91660b3
MD5 f4ab49129cb7e66d6b135491bfa15b5f
SHA1 50cc8b053172f57249942e64c6c3c62d68f12144
SHA512 997f191ab48bc42ff8cd7f37e0bde0f7488e277adea3b9afc7a5ba6f67781e0bb2a808bd816b5e411b601f5aacb3a13b40f3017a7e7a0db16be102a16733d94d
SSDEEP 49152:WoQ4mMlKqnhcEugq1NTxoPCdIA1sITLl3oKJ6mEO2lHI:WoceWXxoo
TLSH
T14EA5C0AA71983394C06BC9389523FD17F676350D0BB186EF37C6B6C02F9B5909A75B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download