7fd5f3ad0b3a152671dabe440ed5a5a05c640da4fe07a9caacb2f3a88d994596

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 16:53

Target
QuickFetch.exe
Size 5.5MB
Sample260731-vd8bpsck6y
SHA256 7fd5f3ad0b3a152671dabe440ed5a5a05c640da4fe07a9caacb2f3a88d994596
MD5 b520698c73c6875ceed62b437b049790
SHA1 ab60377925e8bc95bb066ff30237b834b8fb2b3a
SHA512 c82c6aa4cdfa3f89fb6a3eb4aada3585611e95de3d250679d06d147b40c810a0ed2c5d94dd0b0fd39c67f33fbb2be3401c143cfe2a0ae496aef5a7ce3d0cdea8
SSDEEP 98304:TDPC9naGU2twiWiVPS2rf+7NemRpPhJ7MWhiUmsGIQI3EKJWh+wXf:TrCLt3KuwImRpZJIWtGIQbgm+
TLSH
T1CE463326F1D89C7DE17163704EE3CA199A317DD3B229488E23616B059C22BC97D7873B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
5004	AutoIt3.exe
2852	AutoIt3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5004 set thread context of 2852	5004	AutoIt3.exe	90

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of FindShellTrayWindow 3 IoCs

Suspicious use of SendNotifyMessage 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 5004	4140	QuickFetch.exe	89
PID 5004 wrote to memory of 2852	5004	AutoIt3.exe	90
PID 5004 wrote to memory of 2852	5004	AutoIt3.exe	90
PID 5004 wrote to memory of 2852	5004	AutoIt3.exe	90

C:\Users\Admin\AppData\Local\Temp\QuickFetch.exe
"C:\Users\Admin\AppData\Local\Temp\QuickFetch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Suggested.a3x
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
    3⤵
    - Executes dropped EXE
    PID:2852

AutoIt3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe
Size 1.0MB
SHA256 92c6531a09180fae8b2aae7384b4cea9986762f0c271b35da09b4d0e733f9f45
MD5 8fa52f316c393496f272357191db6deb
SHA1 b1ff3d48a3946ca7786a84e4a832617cd66fa3b9
SHA512 c81da97d6980d6a5aa612070477950a1386239bb919e762f7870bccd459a03da48f8f169910b91f3827c6cfef50471569c9e0c9ff2ceb897904d81840c087d51
SSDEEP 24576:5TC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBB:5+6AqSPyC+NltpScpzbtvpJoMQSq/jre
TLSH
T1FC357D0A23A4419EFEA7F176D617C60BD7B1784A0376962F02A46B726F337711A1E331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Suggested.a3x

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Suggested.a3x
Size 4.9MB
SHA256 75bef57e7af66f89e2347418e34b4764aab9fd6d06c4e18e20d7196a59e2395c
MD5 607a2321cd2d8d9719cd22e82be44cce
SHA1 d79d12cbc4d57aa82a3b5165e5a772e4a24811e9
SHA512 16ffd34ad8b5f2543cfbff2c50fb6b8d501e9e011aa37d7f8de3831ce7827380edd58f4a24fb99ff70bdd7a8570618930828e6289aba25506fcf5560479ce918
SSDEEP 98304:Y98un+MwP1WIVZYI+HwEsDS5deCG8PKo+y9pGjyO0nKqBh68:Y9wtWbpqS5dpGAKKGjy9vz68
TLSH
T18C36333DF5DDEC7DA1B161414E92D918DA252AE7B00E4C9CAB762F00D814A4D3EFCA36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2852-10-0x00000109DFCE0000-0x00000109E0090000-memory.dmp

Download

memory/2852-11-0x00000109DFCE0000-0x00000109E0090000-memory.dmp

Download

memory/5004-7-0x00007FFD0E940000-0x00007FFD0EBA3000-memory.dmp

Download

memory/5004-8-0x00000228947C0000-0x00000228947C1000-memory.dmp

Download