Analysis
- user interaction
yes - max time kernel
150s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/07/2026, 01:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
freefn.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
freefn.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target freefn.exe
- Size 384KB
- Sample260712-b284csd16x
- SHA256 61bd12a88e8a8a612b7341100ca58d9ddb2fa45f46508c0717bfd9495f25c978
- MD5 b7e931f7d22a960627f6a9898d728a9f
- SHA1 73aa609d5558cf8cc28c6da7eeac4cab6cdbeea3
- SHA512 6e8e6039f7d66c4f84d8ce2f02f23411a4d71c7f2729351668700b12dc93b47693d9a6f9d198b173d6a77564863bc7d9afd05ffa3d6277fd099de4c96756e69c
- SSDEEP 6144:MfPHa4q2jOq0Zz67zJhEiLXAXMbAIapO8PoEXUPOUwB1FdAfdwOjkRhjQHnnzpbv:sH0hIfuRpO8w2AOFknnzpvl
- TLSH T132848E45F1A440E9E06BA07896BBF60BE935384D075059CB73E84D942BE37F07BBA742
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3980 freefn.exe 3980 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe 3096 freefn.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3980 wrote to memory of 3096 3980 freefn.exe 88 PID 3096 wrote to memory of 3792 3096 freefn.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\freefn.exe"C:\Users\Admin\AppData\Local\Temp\freefn.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\freefn.exe"C:\Users\Admin\AppData\Local\Temp\freefn.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:3792
-
-