Analysis
- user interaction
yes - max time kernel
148s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 00:58
Behavioral task
behavioral1
Sample
svchost.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
svchost.exe
Resource
win11ltsc2024-20260629-en
3 signatures
150 seconds
General
- Target svchost.exe
- Size 474KB
- Sample260705-bb2atsfx6x
- SHA256 5cb2c02f1d6ddfed8b7ff1a4751760c0036931963a42ca67e80beed388a0a1d3
- MD5 8793d90941d88573e6b4a45417a28b66
- SHA1 fa0f566a71f9581d7abefc63eb98715767942504
- SHA512 f6f9683cd8c9daed8f6fef7fac49e21063d21ed0b60bccdb619749c69dd9dd77bcca42350061a91f4d35d1cf9f5e762ed6e74e57433b2854a0a7a30acf8e91e8
- SSDEEP 12288:bR3CUl7+rakv/AoWH7EnN2Fc3hsf1LW3LaTm3qKcdvCF:N3zlb+/AoWbKvswLgmaJd
- TLSH T12DA423FBA8679B8ED75465B28262922CC01E268F3256440F7CDC9C3587A34ED385D62F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/5828-0-0x0000000140000000-0x0000000140148000-memory.dmp upx behavioral2/memory/5828-1-0x0000000140000000-0x0000000140148000-memory.dmp upx - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5828 svchost.exe 5828 svchost.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5828 svchost.exe