a482a5355ac2b9d449f9b3fe1eb4bdae07e7067937f283818549e3da16395ec8

Analysis

user interaction
yes
max time kernel
96s
max time network
68s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/07/2026, 21:46

Target
cREATIVE 2 (1).rar
Size 34.9MB
Sample260726-1mt4bsdr31
SHA256 a482a5355ac2b9d449f9b3fe1eb4bdae07e7067937f283818549e3da16395ec8
MD5 7f4675d7be8388a953a70fd588c9578b
SHA1 d1b55c02803cffc0adcbc0d7035f966b1f40adb8
SHA512 a8a77b6f445dadabd170b5c61e34f980232bbd8a666cb0e07dfa0a47c781ddd9c95c11ebef0eff0147b135f19cec304f9e7db50a50470409c1f1c97d38239df1
SSDEEP 786432:vM74y0nhhopDZm5ROoD3rg/ZbHFTIWwHuWBcKyrhQ6jGlGdxpmkUK7EYNmO:vM8yg8TmbOi3rg/Zbl8JHuWZyrSlGdKY
TLSH
T1C98733FA25DC95C7BFF3B7F9B12800E250AD21359DA2D8C2638790236F2B72499D7914
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
820	Creative EAX Settings.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2944	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2944	7zFM.exe
2944	7zFM.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 820	2944	7zFM.exe	89

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\cREATIVE 2 (1).rar"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Users\Admin\AppData\Local\Temp\7zO08B4571B\Creative EAX Settings.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO08B4571B\Creative EAX Settings.exe"
  2⤵
  - Executes dropped EXE
  PID:820