Extracted

• • Target

    ac89d5056e7eee1fdf4334f98da67ba5fd9e03b1de99e7ece4e3ec9c6edf0c67

  • Size

    49KB

  • MD5

    30e91446a5174e869559307991a483d7

  • SHA1

    e1a8b3423eb5b8d35e563d69cfd9d8543de2618d

  • SHA256

    ac89d5056e7eee1fdf4334f98da67ba5fd9e03b1de99e7ece4e3ec9c6edf0c67

  • SHA512

    af8258238d602697a8ae0c7e965a90f1ac7d0ed2fae24bc7874e82fba55b075854d9ab38a07139e48ae30ab9ebd6c7e86e73b3aa76742c5324d240b0f02e4ce6

  Score

  10^/10

  persistence

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Sets service image path in registry

    persistence
  behavioral1behavioral2