59869db34853933b239f1e2219cf7d431da006aa919635478511fabbfc8849d2

Analysis

user interaction
yes
max time kernel
898s
max time network
495s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/10/2026, 12:05

Target
New Text Document.txt.gz
Size 20B
Sample261024-n89ppatzcv
SHA256 59869db34853933b239f1e2219cf7d431da006aa919635478511fabbfc8849d2
MD5 7029066c27ac6f5ef18d660d5741979a
SHA1 46c6643f07aa7f6bfe7118de926b86defc5087c4
SHA512 7e8e93f4a89ce7fae011403e14a1d53544c6e6f6b6010d61129dc27937806d2b03802610d7999eab33a4c36b0f9e001d9d76001b8354087634c1aa9c740c536f
MD5 SHA1 SHA512

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000_Classes\Local Settings	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1660	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1660	7zFM.exe
1660	7zFM.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2472	1660	7zFM.exe	82

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\New Text Document.txt.gz"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zOC7677EE8\New Text Document.txt
  2⤵
  PID:2472