1601848740312537f5a53581bfebc213aa06482b1f48adaec32898bc2ac350a7

Analysis

user interaction
yes
max time kernel
36s
max time network
37s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/07/2026, 09:15

Target
yeniemu.exe
Size 794KB
Sample260720-k722nsft8v
SHA256 1601848740312537f5a53581bfebc213aa06482b1f48adaec32898bc2ac350a7
MD5 692db56ee9b84caa1c3ce70f6d6ee57e
SHA1 382dc294aed15f2fd361ccfff0d394a7dead81cf
SHA512 d418cdc532826d6e0f54ec2424025aa6c0a7dfb218b9592869180a1aeceb40b41b4a3a806bba41f8831040aaf3eb0bba2500e5e55442905a73aff6bc9996958e
SSDEEP 24576:JdokdE/ZonTBmV0RnoUIxHVRkr4cnbABpsX+kZllnJVDQK:zoBonFRnGBkEcnbABpsX+GllnJVD
TLSH
T12A059E6EABA801F9C17BC178C6575207E7B274591330A7DB13E08AA92F13BD16B3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1600	sc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4744	yeniemu.exe
4744	yeniemu.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4744	yeniemu.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 1600	4424	cmd.exe	87

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\system32\sc.exe
  sc query vgc
  2⤵
  - Launches sc.exe
  PID:1600