Analysis
- max time kernel
898s - max time network
453s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/06/2026, 00:45
Static task
static1
Behavioral task
behavioral1
Sample
21d49087-6908-4dc1-9a59-865713accaeb-8.png
Resource
win10v2004-20260513-en
2 signatures
900 seconds
Behavioral task
behavioral2
Sample
21d49087-6908-4dc1-9a59-865713accaeb-8.png
Resource
win10ltsc2021-20260513-en
2 signatures
900 seconds
Behavioral task
behavioral3
Sample
21d49087-6908-4dc1-9a59-865713accaeb-8.png
Resource
win11-20260513-en
0 signatures
900 seconds
General
- Target 21d49087-6908-4dc1-9a59-865713accaeb-8.png
- Size 919B
- Sample260627-a35a5agy6q
- SHA256 14e87a5071a9060e5a329cd0c3022825e76a1c1c3377e2cdc39a9a577de1137e
- MD5 682252ec51a97ddce21d777d2c250caa
- SHA1 cbeaa24aee1226458cfc08c266ce8c3a1e926e08
- SHA512 b0765e1fd3c7ac68b467eb002ad8669e701bc0b89627657aebf57e3f05e5b39aa9d0b852395de378c3a860eaf7782bec17d46ffd9a3f0b406cbf080d705a53dd
- TLSH T1AA1180D7DA8ED8E9C5CB1DF92FA755A094B705CD1743220CB61594C50E38C0C8741541
- MD5 SHA1 SHA512 TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1344 mspaint.exe 1344 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1344 mspaint.exe 1344 mspaint.exe 1344 mspaint.exe 1344 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\21d49087-6908-4dc1-9a59-865713accaeb-8.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1344
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4732