81b98a50bc77faedb655fa647eefeff3869b3f79a7806c73e08efb696822194c

Analysis

user interaction
yes
max time kernel
12s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/08/2026, 04:41

Target
Emu.exe
Size 198KB
Sample260802-fa5dbavcrd
SHA256 81b98a50bc77faedb655fa647eefeff3869b3f79a7806c73e08efb696822194c
MD5 b5509c17f25c65c50d7451bd7956951d
SHA1 f28e5bf3c37eebc2d8eafbdabe166a46168fdc35
SHA512 7c9eaab31b1045eeefb3f8ed5c117935daa87eecba74f2c11703583a3cbc93031f03006dfe3c9188d5524cba6b6a8ea822ae298014e27d7eba9dd691a2f3dba2
SSDEEP 3072:mgYXQ7HVpmU8PTXTRDeclwPsYOm9zFdIjgNBbD8SL9KReZovCNANkhteCIoTYAKT:mgYQHVpmU8PTXTVec6Hg8nrOzJ8k
TLSH
T191146C36AD2450BDD36AC079FA53DD02EF32784B4365E6DB17801AB10E176E99E3EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5144 wrote to memory of 4916	5144	Emu.exe	81
PID 4916 wrote to memory of 3748	4916	cmd.exe	82
PID 5144 wrote to memory of 5072	5144	Emu.exe	83
PID 5072 wrote to memory of 3196	5072	cmd.exe	84
PID 5144 wrote to memory of 5100	5144	Emu.exe	85
PID 5100 wrote to memory of 6128	5100	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\Emu.exe
"C:\Users\Admin\AppData\Local\Temp\Emu.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgk >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Windows\system32\sc.exe
    sc start vgk
    3⤵
    - Launches sc.exe
    PID:3748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\system32\sc.exe
    sc stop vgc
    3⤵
    - Launches sc.exe
    PID:3196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\system32\sc.exe
    sc start vgc
    3⤵
    - Launches sc.exe
    PID:6128