ebc214981fa4f45a49f3c9a4a262f78f8347fa492436843c34dc5fe900c1ebd6

Analysis

user interaction
yes
max time kernel
39s
max time network
43s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 14:20

Target
Timelapse.Native.exe
Size 76KB
Sample260910-rnf4esyvay
SHA256 ebc214981fa4f45a49f3c9a4a262f78f8347fa492436843c34dc5fe900c1ebd6
MD5 7055c935729cb1ccc7b23a893a94bd5f
SHA1 6f0d04e96e957b370d21e3fc7579848092aba10e
SHA512 fbee8c574267269956c24a2bcffdc1f7d7468078b444cfc70c49070ef6bdc3ee752f4adc2df70249573c1575052d990315ae4442bd5d3abf295c576c6e9ce4ec
SSDEEP 1536:Eo97wQO4Z8d7UcKW+U4la8n7KsLMs06bs/Jiou:EoVwQoKWa7r306n
TLSH
T13A737C5BA7D410E9CD2BC1B8C63A6657DBB270A4132193CF4770D8A12F616E36E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: LoadsDriver 6 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6032	ShellHost.exe

C:\Users\Admin\AppData\Local\Temp\Timelapse.Native.exe
"C:\Users\Admin\AppData\Local\Temp\Timelapse.Native.exe"
1⤵
PID:3524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3728

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004F8
1⤵
PID:3168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:1924

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:6032