79637a35248c31c3918d7588696966cd694e99a41c4557bc0659073f97d4911b

Analysis

max time kernel
149s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20260130-fr
resource tags

arch:x64arch:x86image:win11-20260130-frlocale:fr-fros:windows11-21h2-x64systemwindows
submitted
15/04/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test.exe
Size 154.5MB
Sample260415-pm36fses7k
SHA256 79637a35248c31c3918d7588696966cd694e99a41c4557bc0659073f97d4911b
MD5 2350ba3aa1c4d5d92b59112554f94eb1
SHA1 9725b210e2a48adac0230b401ff464692fe8080a
SHA512 842dc6ef2133d1213e7f32ec15f171cad29a7de0f7ca11262f6e01351894e53bcc5c2943ab85b339d5292c54f535a2e2ff1dd9334909d2a58be99d7085199b0f
SSDEEP 1572864:QCquurbtqKajQe7vqrTU4PrCsdCXrBngPE1cG7VOWe2IkBmUgq3Fd6iU3x6VCdbm:qDAgZi
TLSH
T1C6788C03E29A10D9E05DD1B58B579637EE72BC460B38A2DF165427522F7BFE42B38B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5504	test.exe
5504	test.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe
Token: SeShutdownPrivilege	5076	test.exe
Token: SeCreatePagefilePrivilege	5076	test.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 1324	5076	test.exe	79
PID 5076 wrote to memory of 1324	5076	test.exe	79
PID 5076 wrote to memory of 5268	5076	test.exe	80
PID 5076 wrote to memory of 5504	5076	test.exe	81

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Users\Admin\AppData\Local\Temp\test.exe
  "C:\Users\Admin\AppData\Local\Temp\test.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\test" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1728,i,11335567748131877672,12355593255130061731,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:1324
- C:\Users\Admin\AppData\Local\Temp\test.exe
  "C:\Users\Admin\AppData\Local\Temp\test.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\test" --mojo-platform-channel-handle=1940 --field-trial-handle=1728,i,11335567748131877672,12355593255130061731,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:5268
- C:\Users\Admin\AppData\Local\Temp\test.exe
  "C:\Users\Admin\AppData\Local\Temp\test.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\test" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1584 --field-trial-handle=1728,i,11335567748131877672,12355593255130061731,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5504-5-0x0000019CCEC90000-0x0000019CCEC91000-memory.dmp

Download

memory/5504-6-0x0000019CCEC90000-0x0000019CCEC91000-memory.dmp

Download

memory/5504-4-0x0000019CCEC90000-0x0000019CCEC91000-memory.dmp

Download

memory/5504-10-0x0000019CCEC90000-0x0000019CCEC91000-memory.dmp

Download

memory/5504-13-0x0000019CCEC90000-0x0000019CCEC91000-memory.dmp

Download

memory/5504-16-0x0000019CCEC90000-0x0000019CCEC91000-memory.dmp

Download

memory/5504-15-0x0000019CCEC90000-0x0000019CCEC91000-memory.dmp

Download

memory/5504-14-0x0000019CCEC90000-0x0000019CCEC91000-memory.dmp

Download

memory/5504-12-0x0000019CCEC90000-0x0000019CCEC91000-memory.dmp

Download

memory/5504-11-0x0000019CCEC90000-0x0000019CCEC91000-memory.dmp

Download