48a4338d999ec5f33b5964c51893a04fc9e2d104b0c7786f50751f7db5dcbe52

Analysis

user interaction
yes
max time kernel
56s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 00:50

Target
Scylla_v0.9.8.rar
Size 985KB
Sample260702-a7c3faaw7v
SHA256 48a4338d999ec5f33b5964c51893a04fc9e2d104b0c7786f50751f7db5dcbe52
MD5 8295a33665f81192b399d3d5b701e1fe
SHA1 98daa48aa786ea087934774e800d9b6dec3ea541
SHA512 420136b1dabffeb0bf52cecf5c974d09cdfc96a84906f29844ae0478761c64b9a444ceac1b7a75cd2fa40268752593553abfd4d7850e6558517de63290486586
SSDEEP 24576:kOBgRoD1A00cMLmWuYHGqqS047IMei7F1cCMZqkkohZ:7bpYLx6A0nni7F1N4qkthZ
TLSH
T16C2533A8EF4AD64B525A329CF5EA06E07BFF22C603A6932F355E3610D09FC845DD5243
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
3504	Scylla_x64.exe
2064	Scylla_x64.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	7zFM.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of FindShellTrayWindow 3 IoCs

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 3504	2720	7zFM.exe	103
PID 2720 wrote to memory of 2064	2720	7zFM.exe	105

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Scylla_v0.9.8.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Users\Admin\AppData\Local\Temp\7zO0AA16E39\Scylla_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0AA16E39\Scylla_x64.exe"
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Users\Admin\AppData\Local\Temp\7zO0AA8D839\Scylla_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0AA8D839\Scylla_x64.exe"
  2⤵
  - Executes dropped EXE
  PID:2064

Scylla_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO0AA16E39\Scylla_x64.exe
Size 500KB
SHA256 47889e39785f0f50d6254ac29eceb2e5b39667eb74986e01d80b3042679f35d2
MD5 9e6ecb3625b7ca4ffb2167958d9cdf72
SHA1 8d8b8ae5d66101fe8b95182708506d90ea6cf471
SHA512 716d2f9c3beec854f0e9598cd030d4ee0bc611cf19ea479d7f2468ad85440a4213f28745c4cf37ae85dcd5566ca9f14b9208efe2d3465ab4fe3e8c38bc716a98
SSDEEP 6144:ojm7X2kYngdKc2jfiF6G1Nmbe40jVEUFlTHYkifA2O9d/ffdcEZUd4rQk:vAHdCmbeNjDYkzfV/Y
TLSH
T151B47C56F7E808E9E077A138CAA3C742E7B274540B70D7CF5668967A2F236E05D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3504-9-0x0000000002660000-0x0000000002661000-memory.dmp

Download