Extracted

• • Target

    a36548eea4f8f9ef285d6677d55fa2eb4bbff386d05e4f513adf66bc1a6a2dba

  • Size

    43KB

  • MD5

    4901423fddb54a564f9ee0a243c91674

  • SHA1

    5c4e62ffaf841fb25c4a936144b58cc6cfbadaba

  • SHA256

    a36548eea4f8f9ef285d6677d55fa2eb4bbff386d05e4f513adf66bc1a6a2dba

  • SHA512

    f6f72ea7fa06c3c7fb5b4cfbf2754381138a43b07b186252ac8edb2d5a3ccc3c04a8a3d002d727cd8893767bf2e15c6ca03bbcbe1c8fab3183897a4dc3ff555e

  Score

  10^/10

  persistence

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Sets service image path in registry

    persistence
  behavioral1behavioral2