44683855826797645cc02d7360607f1b331f32b6ac5dcc946061910f1b069ba9

Analysis

user interaction
yes
max time kernel
30s
max time network
14s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 03:47

Target
كرتييي.rar
Size 6.7MB
Sample261023-ecc66szt9q
SHA256 44683855826797645cc02d7360607f1b331f32b6ac5dcc946061910f1b069ba9
MD5 a630960b514a0cb762d4dc033f39e196
SHA1 51d23d69271e0e141180f561a329a2801d878d3b
SHA512 45db51be647a1f238977014c8a031c558a162f7fb1507ba5b16f131f5b07128fd204844904b34f3494b1a5c882d988fc88555b14e6667507373d5ed62e577d7c
SSDEEP 196608:jOkxJ0Qxo8GSw6/hH+UzdbcR/fGrh3Fv9q:jOwjm8Fw6/he0bcRnGX0
TLSH
T1F766338BE2515ECA61B348BDC3952913F00F7E74A28C961FA1569283EC7F64A53B743C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 3 IoCs

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2852	7zFM.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Suspicious use of FindShellTrayWindow 6 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 1832	2852	7zFM.exe	91
PID 2852 wrote to memory of 116	2852	7zFM.exe	98
PID 2852 wrote to memory of 2232	2852	7zFM.exe	101

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\كرتييي.rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Users\Admin\AppData\Local\Temp\7zO42BA54B8\CreativeEAXSettings.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO42BA54B8\CreativeEAXSettings.exe"
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Users\Admin\AppData\Local\Temp\7zO42BBA2D8\CreativeEAXSettings.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO42BBA2D8\CreativeEAXSettings.exe"
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Users\Admin\AppData\Local\Temp\7zO42BF6BE8\CreativeEAXSettings.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO42BF6BE8\CreativeEAXSettings.exe"
  2⤵
  - Executes dropped EXE
  PID:2232

CreativeEAXSettings.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO42BA54B8\CreativeEAXSettings.exe
Size 1.0MB
SHA256 af50ab0bc18ddf087b792313aeea1c0f6faac0339052c2d68cfcc9713972a489
MD5 7c81673395ffcdd8795b3e60f587f506
SHA1 123285f41aace679956897c2463f9ffca5838039
SHA512 9b184f8fe69a5987b1c8eb646f6badd60a82f521f5c9d43190c09ab7c0898e3c6bea834b645d6a3c808473b20a3f24f40723656c614b7e063583b643c2a5c38a
SSDEEP 3072:4J+TmlZtqtMA0eLSFLgvYsejxtttjggg7sss4dddqddd7zQT14q:qqGAGLgvYBjnggg7sss4dddqdddY14
TLSH
T11D3587A970F66CDAC13D01FAF9BDAE85F2552D4C8F59B20A36127E2409F230CD84D9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1832-12-0x0000020AF01B0000-0x0000020AF02BA000-memory.dmp

Download