cd4a90dc6d9ef79f1cebc8adfab7135ee45807d0e3207a110a9d4b7908d94290

Analysis

user interaction
yes
max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 17:55

Target
example.png
Size 245KB
Sample260722-whyhqs1cmd
SHA256 cd4a90dc6d9ef79f1cebc8adfab7135ee45807d0e3207a110a9d4b7908d94290
MD5 f2fdd4ce6327ed8e4c67c62e38cae0e6
SHA1 2591618bfaea8fb6e602d19bd06ecc62cfbeebb4
SHA512 986ec843f40edc55e699892795ae58bdd0fcfd73ed5badcc4de68fc08473e04e0ddab0a7fcae58b22482a31d49e5ab43feaa6c131d7e5f9aa573626919378fbc
SSDEEP 6144:4hCuoO0Gc+RAmc6f7kE5PO8Lk5b8ESCsa2e6kAhFZG:aoO0Gc+RAmcGyMk1HSCsWAo
TLSH
T1373423CE28060F8E69267FAE65B7C734BAB0D32C5163433271DB718797550D4C1B29AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4340	mspaint.exe
4340	mspaint.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 3108	3572	cmd.exe	118

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4588

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Windows\system32\curl.exe
  curl -X POST https://cdn.appz.lol/api/request/cloud
  2⤵
  PID:3108