815b7e862b3755d5ab8af72361b92dbd5e39c2007ac9d3c658e004c915f2ffdb

Analysis

user interaction
yes
max time kernel
150s
max time network
84s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 13:44

Target
Fivem Dumper.rar
Size 140KB
Sample261107-q146cact9y
SHA256 815b7e862b3755d5ab8af72361b92dbd5e39c2007ac9d3c658e004c915f2ffdb
MD5 d366d9cb600d92b1b64760419befb313
SHA1 846d2b17eda33f1f5ae430e300925c102bd07be5
SHA512 3a2d9a58e35c0096dce752e83ac8bf397ad9945e2cb0a99c851f1b773ac6d1793bfa7c31b885c014679d787e152ad3d19a2c95a7e26297fe34bb3fe062566c4a
SSDEEP 3072:JFWYtQOH10zIDPpPArjWvUKChvRsacdvS2LdVH3h0:GeQNI7pPArqvUPRny/LdVHa
TLSH
T1FAE313A13494337332DC62709C4A2907CD2391F71093AEEB7DD19B640B78E68A67D9E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

ransomware

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
1816	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5392	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5392	7zFM.exe
5392	7zFM.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1008	OpenWith.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 1816	1008	OpenWith.exe	91

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO0151D4B9\fivem_offset_dumper_reconstructed.cpp
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1816

fivem_offset_dumper_reconstructed.cpp

Path C:\Users\Admin\AppData\Local\Temp\7zO0151D4B9\fivem_offset_dumper_reconstructed.cpp
Size 18KB
SHA256 255c39cc82218e6b853bb3918463d3b3660b938a99d7ceca89f6c8d2223d6c4c
MD5 ff870882864ba7157dc39fb0796d36e2
SHA1 79a274f7b9d1f2338f30f7d48954b980e26c9223
SHA512 22a74d5f8dc4edae8b37c5b6e3d92d8b43e48f5ad3902cd243154c25db68945962db4cd99e3ef69a9195def09e7e4ebc43ab8c45725bd1851f6bcbecde95d501
SSDEEP 192:TlLZRca4YSbC6++ytKaW+s0UsJSo6sHQLgIJAykWaSCyPnqodadsjSNXZgS1jfyC:TlLXsWSSw+o7kdy2mXY
TLSH
T17A825448CCB61D9D0943EA291B5F0C01D5BC40170DB6DE2AFE8E43A82F5E31E69BD796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download