df8a6feb356d10bd605323be5f9842f959d40d99d7d100d6c37cafbe6f179d51

user interaction
yes
max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 11:45

Sharing

Target
Risxn Cracked Tweak (1).rar
Size 939KB
Sample260819-nw71bsvxas
SHA256 df8a6feb356d10bd605323be5f9842f959d40d99d7d100d6c37cafbe6f179d51
MD5 1591879409594670740f21ee85209f52
SHA1 29079c5dcaa61670f6a6d0533ad1c4b2cd591105
SHA512 4a67fc8ca4f66a3d34b3de31528669e55841ca70333e769b3a0557444aa8020ef5d74b9e500950861ee86edeacf5d30e58bef1b06578f73bab720165ecc539b9
SSDEEP 12288:j095NKP+3EPq7q20w36ZL0x9aW/OoST4ziA364ZwMY5okOaYTvXIvPEK8POB:Q95qS+BZ299/OoScziQhZwMYnaTv4Iu
TLSH
T1B02533CC98F2C09BA167A3331D991D8446E2F2992633937E5EF70B652BE40D150B877B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3964	KeyAuthEmu1.3.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1512	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1512	7zFM.exe
1512	7zFM.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1512	7zFM.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 3964	1512	7zFM.exe	91

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Risxn Cracked Tweak (1).rar"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Users\Admin\AppData\Local\Temp\7zO8E5F0E5A\KeyAuthEmu1.3.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO8E5F0E5A\KeyAuthEmu1.3.exe"
  2⤵
  - Executes dropped EXE
  PID:3964

KeyAuthEmu1.3.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO8E5F0E5A\KeyAuthEmu1.3.exe
Size 135KB
SHA256 93482943e4b184bf53b7b19c460fd273d24c5faf0ec98b7c2e2e1e7eee9282ac
MD5 6a1e370f2ea783fe05fc4e7e8f2bb0fe
SHA1 1b974c9ed7ce6442ba1947c64d6f1ddaff75c775
SHA512 ec6f585f81622bb6dacedbeda7ce37b4f4969c576a2b32402aa5228b8087e94a7dba570870698dadf40dab1db9b87c1a502fbc5a035edb4b037662903b929714
SSDEEP 3072:zhK4Uay3XrQ8habqgp9pC9Z6p5uf3C6k0xuZ04ntfx9RhBur:zhK4XycqgpfCup5sVxuZ041RhA
TLSH
T153D32903B2AC11FDE1BBA37C89A21A05F3767819477297CF0390856A1F67BD09E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download