Analysis
- max time kernel
899s - max time network
428s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 10:01
Static task
static1
Behavioral task
behavioral1
Sample
Textdokument (neu).txt
Resource
win10v2004-20260513-en
24 signatures
900 seconds
Behavioral task
behavioral2
Sample
Textdokument (neu).txt
Resource
win11ltsc2024-20260709-en
1 signatures
900 seconds
General
- Target Textdokument (neu).txt
- Size 1KB
- Sample260730-l2j5cafd88
- SHA256 6c7c46c1589d8b78590880b73a06469dbf4b1b5fb66098c2aaaee72e59628d49
- MD5 43b345e10148bcb5084a6b9fd6d6f59c
- SHA1 4185371b8fb318f6bd5b4f1a513103728491181d
- SHA512 e9d45aaae40353f518a522ffa24fc20501ba78e2ec50a6ecf64ec01ed5eafd5c40759e0b1a0a6092f81ad004c7001fe3d400863e028c7a2d5e555d1914742339
- TLSH T12D21330B0F796A05399FE0426D9EC541AB9281152CAEFAFAD3B893970E00DCC7D096E5
- MD5 SHA1 SHA512 TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3384 NOTEPAD.EXE
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\Textdokument (neu).txt"1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3384
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5372
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:576