e903c1115dc251201ae4a6ed3b362b2b665a153af1420dd949c90a92e9fd0ca7

Analysis

user interaction
yes
max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 02:28

Target
Hudra.rar
Size 105.3MB
Sample260724-cx9d1afl21
SHA256 e903c1115dc251201ae4a6ed3b362b2b665a153af1420dd949c90a92e9fd0ca7
MD5 37bcc57a7815eed8fedf00012cc7a252
SHA1 8fbaae5abc02ca766fbbe979750755141f242e99
SHA512 c909f80cf0b8cf2591a4a3e997fecf5a8b8ad9b27a728d40c4e552a122c8dc44c2f7c6c12eef2a2cbd6058c8281f18cd198e8491ebbbdfcfda85ed962748f675
SSDEEP 3145728:aqjOB92UIGwyoCVOpXXFx7yhU2qKNpfxCqqpG+q2/rBx:S92ZGwyDM1FxgU2vfxjqpGkBx
TLSH
T1F73833C979D4F269031903CD12D7B7BF1A1E4695CBC27DE08909A2CEA9EE03860F575B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4732	SoftWare.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2352	7zFM.exe

Suspicious behavior: LoadsDriver 6 IoCs

Suspicious use of AdjustPrivilegeToken 6 IoCs

Suspicious use of FindShellTrayWindow 8 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2924	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 4732	2352	7zFM.exe	89
PID 2352 wrote to memory of 1984	2352	7zFM.exe	95

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Hudra.rar"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Users\Admin\AppData\Local\Temp\7zO03984E79\SoftWare.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO03984E79\SoftWare.exe"
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" cryptext.dll,CryptExtOpenCER C:\Users\Admin\AppData\Local\Temp\7zO039B8F89\.CRT
  2⤵
  PID:1984

SoftWare.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO03984E79\SoftWare.exe
Size 683KB
SHA256 715b4174065916a6412f60b3c10664b323dc737fd717ab09627083be34626fe0
MD5 6669e10c960f6c2297bcd3d5a27412aa
SHA1 73bee544b24312d0057d9ce5e62daa9f73243d00
SHA512 feb1e93aed3f1a0ade6e6ab169af46ddd438aa80f6667fb24421d2f0b7da1c4a4902438421079a75eecfc9a3347c3ebe7f62b88ea9e67a9c951954d8555ea497
SSDEEP 12288:tiGbyLR32C4NHhZoLCZcvDaLgf5pB6Nwi5//E7soazN0uahRg:MGboR3P4NHboLCevWLGL6//E7sTN0hhC
TLSH
T1ECE48E2AB3E401F9D1B7D276C9535A26FB71780A1731CBCF03A046562F276A49E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.CRT

Path C:\Users\Admin\AppData\Local\Temp\7zO039B8F89\.CRT
Size 88B
SHA256 4da0337b4ed795ae2ac7704a101de94fa27b62d9c91c9ec19545fd60ba7782e3
MD5 80784c5e875080a84a385f651334b015
SHA1 1a11ab359c9ab5917c0bb144ec5e28efa4ef2311
SHA512 3061685554273173839435c27eb5261f9ce092b34e84c809bde5001edb46e801cedecdd64a3e41eddba24abfbdb1b81ab708304ffe577254d96475c1cf6504e1
MD5 SHA1 SHA512

Submit Download