a89d50884b1f12fed4811803625a270e132555d013d26c211907fd8e480830e8

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 06:24

Target
b7dcf6cf-b304-498f-a252-19ea796cd898.exe
Size 248KB
Sample260816-g59rysem3x
SHA256 a89d50884b1f12fed4811803625a270e132555d013d26c211907fd8e480830e8
MD5 db0272f22913973dd0e10a4ce7682580
SHA1 c5c5819c4996a291042bdd819c16fcf0cb505856
SHA512 c8bda14715b9081122104a6824ff31053bc68bcb37531339753f6b21f0cadcd5b5abf1d83864d53ee7f156932945b415ae807a645188e60c8cd29517f4b121e8
SSDEEP 6144:NDgfruqoTsl/t/8ATCH1rplg8H6Oq4g+fF:Njhgl/t09HrlZVqluF
TLSH
T175447C3DBA280CBDDA6EC079EE83C906DF327C474365D6D713905AA20E176E59E3DA01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 6856 wrote to memory of 5824	6856	b7dcf6cf-b304-498f-a252-19ea796cd898.exe	91
PID 5824 wrote to memory of 2468	5824	cmd.exe	92
PID 6856 wrote to memory of 616	6856	b7dcf6cf-b304-498f-a252-19ea796cd898.exe	93
PID 616 wrote to memory of 4532	616	cmd.exe	94
PID 6856 wrote to memory of 4764	6856	b7dcf6cf-b304-498f-a252-19ea796cd898.exe	95
PID 4764 wrote to memory of 4828	4764	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\b7dcf6cf-b304-498f-a252-19ea796cd898.exe
"C:\Users\Admin\AppData\Local\Temp\b7dcf6cf-b304-498f-a252-19ea796cd898.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgk >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5824
- - C:\Windows\system32\sc.exe
    sc start vgk
    3⤵
    - Launches sc.exe
    PID:2468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Windows\system32\sc.exe
    sc stop vgc
    3⤵
    - Launches sc.exe
    PID:4532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start vgc >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Windows\system32\sc.exe
    sc start vgc
    3⤵
    - Launches sc.exe
    PID:4828