0640465fb6b53027d6bd0236922d693311c8a56875d4b03ff835dc68856c0ddc

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
01/07/2026, 12:55

Target
Coolorus v2.7.1 vfxMed.rar
Size 397KB
Sample260701-p54vpsex2m
SHA256 0640465fb6b53027d6bd0236922d693311c8a56875d4b03ff835dc68856c0ddc
MD5 4a3e4d37924d23c4083141249155ca34
SHA1 b3909d4ea6b1df1e39550579b3328d807aa71164
SHA512 f8c6b5378708902293b7198815856e4e03c6e05de3b758dd8498e9e59f280ed49e876bf2d090579005e9a3b43b615914af3fc0a80328784925db8fec2df22171
SSDEEP 6144:E/xFypyyupqDasoVyITf36MrCH24Gd+nmQZVWODVLD6IA3FUS9mU:sxFZys6O/+xZFRv6INQr
TLSH
T143841247B775E8228E33307E30CE94FD65184AC6C7D195AEAA7CE349B57CA0D9A4DE00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\Local Settings	7zFM.exe

Runs .reg file with regedit 2 IoCs

pid	Process
4776	regedit.exe
3792	regedit.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6116	7zFM.exe
6116	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6116	7zFM.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Suspicious use of FindShellTrayWindow 7 IoCs

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6116 wrote to memory of 4776	6116	7zFM.exe	83
PID 6116 wrote to memory of 3792	6116	7zFM.exe	96

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Coolorus v2.7.1 vfxMed.rar"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6116
- C:\Windows\regedit.exe
  "regedit.exe" "C:\Users\Admin\AppData\Local\Temp\7zO4E707158\Add Keys.reg"
  2⤵
  - Runs .reg file with regedit
  PID:4776
- C:\Windows\regedit.exe
  "regedit.exe" "C:\Users\Admin\AppData\Local\Temp\7zO4E7863C8\Add Keys.reg"
  2⤵
  - Runs .reg file with regedit
  PID:3792

Add Keys.reg

Path C:\Users\Admin\AppData\Local\Temp\7zO4E707158\Add Keys.reg
Size 4KB
SHA256 92c80c435d73b7467c0e033f50fa0c13ac9d880c059f660ff683e53794ef210f
MD5 37a0eaeddfcc5295d748113656dd03ed
SHA1 00a9c155c837163f8754216840cb1b4aab4a4e90
SHA512 6142167f9fd6857f03fe0c3c9fed0fb6af437718acddb0d317d010736e0f9918c8a933b79c8ccc52f907b2462d1031e4ec2cbe2885749cf4bc187090457230e6
SSDEEP 48:tnQ/QMQ4cQyQOQuQIKQIQbQ6QNQUQnQGQ5QzQpKQZQmQ/QMQlQyQ8:NuB3cbfH9Kta7ohO/MCcKcP2pQDp
TLSH
T186817D2316E5718D36A32485DFF9D864A332B6E69209DA5F26F00E0F68E35044601FFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download