c2fd413ce7418ae0254ff45f6931f269c4989e7d22dd503605f45da9a4b2dfb8

Analysis

max time kernel
599s
max time network
445s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 15:05

Target
AMDRM_Install.log
Size 1KB
Sample260702-sf66bady2l
SHA256 c2fd413ce7418ae0254ff45f6931f269c4989e7d22dd503605f45da9a4b2dfb8
MD5 824f9ed86f8ee7b414eb97e60692a353
SHA1 1d43b6a336682dcb3d179c04b027fc69738eda56
SHA512 63041d483efceaf28f63a2dc14b050608df80fba19e42567a546ed51f6a306aa3fe4bb6aa0062d045483da6894c7cca0bb28d3268a93629f1f968df19c8d4d14
TLSH
T12F31CF1D4BC0A4666D12F265661F092BE25DE4E70F140C74FA8D4058C36ADBB8D3E5D0
MD5 SHA1 SHA512 TLSH

Score

1^/10

ransomware

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
1792	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\AMDRM_Install.log
1⤵
- Opens file in notepad (likely ransom note)
PID:1792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6588