ba3b2a594aa2552f255b1ce5b02ddd687374306c9657ed06a38c6d6d6338d441

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pulse-watchdog.exe
Size 442KB
Sample260908-dazrqabq21
SHA256 ba3b2a594aa2552f255b1ce5b02ddd687374306c9657ed06a38c6d6d6338d441
MD5 1f618f5bb4975ff9a0bcdf2bf8d3859a
SHA1 39527e12ad5bef8f15c184faf53743c59d3829c5
SHA512 e40dbff81a4c0b25d397a41644508923a9ada483a36e6ec93bf785f35068d1006299f41d644cd8b062c9a1a44b2c1f5d6217bc7feb944b99643322c732486be5
SSDEEP 6144:WM/VIWCzB+NOjMoiAZA51Cqx/JQHiRdFV98YY5MoUmuIg8J://2WozIBx1Tx/36YiMCu
TLSH
T1A1A44B11775A98BDE449C474C30A86B36A2674CA0B26B9FF41D8A5383F79AF06F3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Discovers running processes 1 TTPs 30 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1104	tasklist.exe
4480	tasklist.exe
1220	tasklist.exe
5008	tasklist.exe
4640	tasklist.exe
4560	tasklist.exe
3012	tasklist.exe
1124	tasklist.exe
4516	tasklist.exe
2148	tasklist.exe
3112	tasklist.exe
2200	tasklist.exe
1712	tasklist.exe
3808	tasklist.exe
840	tasklist.exe
3192	tasklist.exe
3136	tasklist.exe
1952	tasklist.exe
2252	tasklist.exe
2128	tasklist.exe
3908	tasklist.exe
4532	tasklist.exe
4868	tasklist.exe
2252	tasklist.exe
4776	tasklist.exe
1760	tasklist.exe
3996	tasklist.exe
1588	tasklist.exe
408	tasklist.exe
2416	tasklist.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	3136	tasklist.exe
Token: SeDebugPrivilege	1104	tasklist.exe
Token: SeDebugPrivilege	1124	tasklist.exe
Token: SeDebugPrivilege	4516	tasklist.exe
Token: SeDebugPrivilege	2148	tasklist.exe
Token: SeDebugPrivilege	4776	tasklist.exe
Token: SeDebugPrivilege	2200	tasklist.exe
Token: SeDebugPrivilege	1588	tasklist.exe
Token: SeDebugPrivilege	4480	tasklist.exe
Token: SeDebugPrivilege	1952	tasklist.exe
Token: SeDebugPrivilege	408	tasklist.exe
Token: SeDebugPrivilege	1220	tasklist.exe
Token: SeDebugPrivilege	2252	tasklist.exe
Token: SeDebugPrivilege	4640	tasklist.exe
Token: SeDebugPrivilege	1760	tasklist.exe
Token: SeDebugPrivilege	4532	tasklist.exe
Token: SeDebugPrivilege	4560	tasklist.exe
Token: SeDebugPrivilege	3808	tasklist.exe
Token: SeDebugPrivilege	840	tasklist.exe
Token: SeDebugPrivilege	2128	tasklist.exe
Token: SeDebugPrivilege	3908	tasklist.exe
Token: SeDebugPrivilege	4868	tasklist.exe
Token: SeDebugPrivilege	5008	tasklist.exe
Token: SeDebugPrivilege	3192	tasklist.exe
Token: SeDebugPrivilege	3112	tasklist.exe
Token: SeDebugPrivilege	3996	tasklist.exe
Token: SeDebugPrivilege	3012	tasklist.exe
Token: SeDebugPrivilege	2416	tasklist.exe
Token: SeDebugPrivilege	2252	tasklist.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 3136	4432	pulse-watchdog.exe	85
PID 4432 wrote to memory of 1104	4432	pulse-watchdog.exe	88
PID 4432 wrote to memory of 1124	4432	pulse-watchdog.exe	91
PID 4432 wrote to memory of 4516	4432	pulse-watchdog.exe	93
PID 4432 wrote to memory of 2148	4432	pulse-watchdog.exe	95
PID 4432 wrote to memory of 4776	4432	pulse-watchdog.exe	97
PID 4432 wrote to memory of 2200	4432	pulse-watchdog.exe	100
PID 4432 wrote to memory of 1588	4432	pulse-watchdog.exe	102
PID 4432 wrote to memory of 4480	4432	pulse-watchdog.exe	104
PID 4432 wrote to memory of 1952	4432	pulse-watchdog.exe	106
PID 4432 wrote to memory of 408	4432	pulse-watchdog.exe	108
PID 4432 wrote to memory of 1220	4432	pulse-watchdog.exe	112
PID 4432 wrote to memory of 2252	4432	pulse-watchdog.exe	116
PID 4432 wrote to memory of 4640	4432	pulse-watchdog.exe	120
PID 4432 wrote to memory of 1760	4432	pulse-watchdog.exe	122
PID 4432 wrote to memory of 1712	4432	pulse-watchdog.exe	125
PID 4432 wrote to memory of 4532	4432	pulse-watchdog.exe	127
PID 4432 wrote to memory of 4560	4432	pulse-watchdog.exe	129
PID 4432 wrote to memory of 3808	4432	pulse-watchdog.exe	131
PID 4432 wrote to memory of 840	4432	pulse-watchdog.exe	133
PID 4432 wrote to memory of 2128	4432	pulse-watchdog.exe	135
PID 4432 wrote to memory of 3908	4432	pulse-watchdog.exe	137
PID 4432 wrote to memory of 4868	4432	pulse-watchdog.exe	139
PID 4432 wrote to memory of 5008	4432	pulse-watchdog.exe	141
PID 4432 wrote to memory of 3192	4432	pulse-watchdog.exe	143
PID 4432 wrote to memory of 3112	4432	pulse-watchdog.exe	145
PID 4432 wrote to memory of 3996	4432	pulse-watchdog.exe	147
PID 4432 wrote to memory of 3012	4432	pulse-watchdog.exe	149
PID 4432 wrote to memory of 2416	4432	pulse-watchdog.exe	151
PID 4432 wrote to memory of 2252	4432	pulse-watchdog.exe	153

C:\Users\Admin\AppData\Local\Temp\pulse-watchdog.exe
"C:\Users\Admin\AppData\Local\Temp\pulse-watchdog.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3136
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1104
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1124
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4516
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2148
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4776
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2200
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1588
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4480
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1952
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:408
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1220
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2252
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4640
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1760
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  PID:1712
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4532
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4560
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3808
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:840
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2128
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3908
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4868
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5008
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3192
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3112
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3996
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3012
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2416
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads