a89d50884b1f12fed4811803625a270e132555d013d26c211907fd8e480830e8

Analysis

user interaction
yes
max time kernel
19s
max time network
19s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 04:25

Target
Emu (1).exe
Size 248KB
Sample260813-e2eras1grg
SHA256 a89d50884b1f12fed4811803625a270e132555d013d26c211907fd8e480830e8
MD5 db0272f22913973dd0e10a4ce7682580
SHA1 c5c5819c4996a291042bdd819c16fcf0cb505856
SHA512 c8bda14715b9081122104a6824ff31053bc68bcb37531339753f6b21f0cadcd5b5abf1d83864d53ee7f156932945b415ae807a645188e60c8cd29517f4b121e8
SSDEEP 6144:NDgfruqoTsl/t/8ATCH1rplg8H6Oq4g+fF:Njhgl/t09HrlZVqluF
TLSH
T175447C3DBA280CBDDA6EC079EE83C906DF327C474365D6D713905AA20E176E59E3DA01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 4536	5072	Emu (1).exe	87
PID 4536 wrote to memory of 4980	4536	cmd.exe	88
PID 5072 wrote to memory of 2608	5072	Emu (1).exe	89
PID 2608 wrote to memory of 1068	2608	cmd.exe	90
PID 5072 wrote to memory of 2588	5072	Emu (1).exe	91
PID 2588 wrote to memory of 1796	2588	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\Emu (1).exe
"C:\Users\Admin\AppData\Local\Temp\Emu (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgk >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\system32\sc.exe
    sc start vgk
    3⤵
    - Launches sc.exe
    PID:4980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\system32\sc.exe
    sc stop vgc
    3⤵
    - Launches sc.exe
    PID:1068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\system32\sc.exe
    sc start vgc
    3⤵
    - Launches sc.exe
    PID:1796