e9021d6be3bf07e19860c6e6a0e44ed2518ac7f328dd94cefc21ffe2a175b34a

Analysis

user interaction
yes
max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 04:15

Target
big.txt
Size 5.0MB
Sample260827-evcncsxwdv
SHA256 e9021d6be3bf07e19860c6e6a0e44ed2518ac7f328dd94cefc21ffe2a175b34a
MD5 06f891193fc3d624bef0351ebf8531e3
SHA1 bea9398109a0004767c4c46ecc53ac5ca4fc9d8b
SHA512 808a054c73862232cd5472d02635aa97d98005d81c2ac4a109f7f7ae4d3c893b5b6097fc934a0cd11b3581b55ac0118d968767954e63049d68bdaafb5838a2d3
SSDEEP 3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkw:Yu
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

ransomware

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
3528	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\big.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3528

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:2540