79637a35248c31c3918d7588696966cd694e99a41c4557bc0659073f97d4911b

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260130-fr
resource tags

arch:x64arch:x86image:win10v2004-20260130-frlocale:fr-fros:windows10-2004-x64systemwindows
submitted
15/04/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test.exe
Size 154.5MB
Sample260415-pm36fses7k
SHA256 79637a35248c31c3918d7588696966cd694e99a41c4557bc0659073f97d4911b
MD5 2350ba3aa1c4d5d92b59112554f94eb1
SHA1 9725b210e2a48adac0230b401ff464692fe8080a
SHA512 842dc6ef2133d1213e7f32ec15f171cad29a7de0f7ca11262f6e01351894e53bcc5c2943ab85b339d5292c54f535a2e2ff1dd9334909d2a58be99d7085199b0f
SSDEEP 1572864:QCquurbtqKajQe7vqrTU4PrCsdCXrBngPE1cG7VOWe2IkBmUgq3Fd6iU3x6VCdbm:qDAgZi
TLSH
T1C6788C03E29A10D9E05DD1B58B579637EE72BC460B38A2DF165427522F7BFE42B38B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1200	test.exe
1200	test.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe
Token: SeShutdownPrivilege	2760	test.exe
Token: SeCreatePagefilePrivilege	2760	test.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2228	2760	test.exe	82
PID 2760 wrote to memory of 2228	2760	test.exe	82
PID 2760 wrote to memory of 4984	2760	test.exe	83
PID 2760 wrote to memory of 1200	2760	test.exe	93

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Users\Admin\AppData\Local\Temp\test.exe
  "C:\Users\Admin\AppData\Local\Temp\test.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\test" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1832,i,13332139386812367455,14263902419310242658,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:2228
- C:\Users\Admin\AppData\Local\Temp\test.exe
  "C:\Users\Admin\AppData\Local\Temp\test.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\test" --mojo-platform-channel-handle=2088 --field-trial-handle=1832,i,13332139386812367455,14263902419310242658,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:4984
- C:\Users\Admin\AppData\Local\Temp\test.exe
  "C:\Users\Admin\AppData\Local\Temp\test.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\test" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1372 --field-trial-handle=1832,i,13332139386812367455,14263902419310242658,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-44-0x00000281A0030000-0x00000281A0031000-memory.dmp

Download

memory/1200-45-0x00000281A0030000-0x00000281A0031000-memory.dmp

Download

memory/1200-51-0x000002819CC70000-0x000002819CD1D000-memory.dmp

Download

memory/1200-38-0x00000281A0030000-0x00000281A0031000-memory.dmp

Download

memory/1200-40-0x00000281A0030000-0x00000281A0031000-memory.dmp

Download

memory/1200-39-0x00000281A0030000-0x00000281A0031000-memory.dmp

Download

memory/1200-50-0x00000281A0030000-0x00000281A0031000-memory.dmp

Download

memory/1200-46-0x00000281A0030000-0x00000281A0031000-memory.dmp

Download

memory/1200-47-0x00000281A0030000-0x00000281A0031000-memory.dmp

Download

memory/1200-49-0x00000281A0030000-0x00000281A0031000-memory.dmp

Download

memory/1200-48-0x00000281A0030000-0x00000281A0031000-memory.dmp

Download

memory/2228-5-0x000001AD96B50000-0x000001AD96BFD000-memory.dmp

Download

memory/2760-2-0x00000155150E0000-0x000001551518D000-memory.dmp

Download

memory/4984-6-0x0000020628B50000-0x0000020628BFD000-memory.dmp

Download