e0c18a96c8a39bbde301dd67c6e33dd4850caac444810440179b148a521f511f

Analysis

user interaction
yes
max time kernel
300s
max time network
262s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 01:28

Target
message.txt
Size 24KB
Sample260728-bv2eyaed56
SHA256 e0c18a96c8a39bbde301dd67c6e33dd4850caac444810440179b148a521f511f
MD5 9dbd248286727f5a59a52a288fd6d23b
SHA1 abb16a67ca57925c25c17e9945269628874fbbcf
SHA512 48a9e60cf80dbade033e336f19bc7743734c58001444c1f79837816d45aec769e382a014715293fe9e6aa5bd557681df8155328f52935d8ef7d74d5170dfd354
SSDEEP 384:dwWW34ZWb9iMFlgb00M72reR820L/sjCJLhEFkrqEDvj:aWW342iMFyb00jI0L/ZyFkrqaj
TLSH
T1D9B24E32FD595416B572C65CD812E031F306B31FB1514A76BEBCB2281FFD836A094ABA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

ransomware

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
4520	NOTEPAD.EXE

Suspicious behavior: LoadsDriver 6 IoCs

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\message.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4520

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1280