Analysis
- user interaction
yes - max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/10/2026, 17:59
Static task
static1
Behavioral task
behavioral1
Sample
file.png
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.png
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target file.png
- Size 138KB
- Sample261003-wksehatfpc
- SHA256 b66219708250f6cef7487d7feec8d947a8d364206bd367182ceaa33bf521981d
- MD5 1ab8a1bf0f9fa28d1a0285c3a53fcc52
- SHA1 4c79e5875383c803b0b11d2cd8d0ede06f16189c
- SHA512 80001a49cec8746bc4a789be7ca8544038642caef0b5c143269557975d7590714041a9f4b04c526897b50d04658243e18edf16f38966c8425d1e05d56884007e
- SSDEEP 3072:412ydjd5mXX1NY3yPZWy1qp1zWQ5ypNACq54SbrIj:45ddgXFNYiPD1q/j5yACqmSb0j
- TLSH T13AD312B7FF6D9B854084E9662BAC6AF4635D27031C70B598BD40323EDF68BD20A07913
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4820 mspaint.exe 4820 mspaint.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4820 mspaint.exe 4820 mspaint.exe 4820 mspaint.exe 4820 mspaint.exe
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\file.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4820
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4564