5f7dc5c4cb4f388f537dab9d6b35e3e1d66aa4a2e8dbcdd2022ac240522a0356

Analysis

user interaction
yes
max time kernel
76s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 15:12

Target
source KINDA WORKING).rar
Size 357.8MB
Sample260913-sllfssydkc
SHA256 5f7dc5c4cb4f388f537dab9d6b35e3e1d66aa4a2e8dbcdd2022ac240522a0356
MD5 82941d48cd984be3900f0939c9bca143
SHA1 f9997c6a50a37fe41bbf8d32acb26841e46da0cc
SHA512 e926bfb8d22f5dc7d7dd0ae05ee30c7bbb91e31bef921b6cb63b79e8a23c93e21265117a6449549207391e2af73161ba688f86b63243cfb42899ebf98cc6086e
SSDEEP 6291456:uqWYQ+blRTWvFrkYu+Py4QtT352uIZvV6q4vUhc8FjdNb9ZVM:hTgFrPuay/t1y14vQ19dNW
TLSH
T19E0933DD7EA23FEB652DA10DDAF7A509A248DCC756F7C003906E1B9864B0055CBAC9C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
6136	Loader.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6032	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
6032	7zFM.exe
6032	7zFM.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6032 wrote to memory of 6136	6032	7zFM.exe	87

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\source KINDA WORKING).rar"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6032
- C:\Users\Admin\AppData\Local\Temp\7zO097E079A\Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO097E079A\Loader.exe"
  2⤵
  - Executes dropped EXE
  PID:6136

Loader.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO097E079A\Loader.exe
Size 3.9MB
SHA256 c2f1fc70f1f20a8cab1c24c4cf320f0012608cb2d7a5305e9b122010341fa7f9
MD5 320ae4f3814dc20145e1758dc1686950
SHA1 66acd9a9e8d95cfe52af9aa34f2931d9c9578a62
SHA512 6c14ae629b549a39c51b241c64f4cbd41ec2be8524c28b892b13c333f3e4d9a708eb1e5eecea7955308e11f6bdf84f0a803293fa366109d481fb02be86c08dbb
SSDEEP 49152:83cQwgoaU/OgrC0Bp00sIR9G9osFyJb7E2grKVlj5lKSzUmnFUwRKj:GnoAgmzIPsonbw7Kbr8uFUwc
TLSH
T1CA16C04793DDAFAAC13264354E01F013AEE2FC048779A3DBF6E19D1961262E40E7CB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download