ba3b2a594aa2552f255b1ce5b02ddd687374306c9657ed06a38c6d6d6338d441

Analysis

max time kernel
150s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pulse-watchdog.exe
Size 442KB
Sample261017-hf1cnaythy
SHA256 ba3b2a594aa2552f255b1ce5b02ddd687374306c9657ed06a38c6d6d6338d441
MD5 1f618f5bb4975ff9a0bcdf2bf8d3859a
SHA1 39527e12ad5bef8f15c184faf53743c59d3829c5
SHA512 e40dbff81a4c0b25d397a41644508923a9ada483a36e6ec93bf785f35068d1006299f41d644cd8b062c9a1a44b2c1f5d6217bc7feb944b99643322c732486be5
SSDEEP 6144:WM/VIWCzB+NOjMoiAZA51Cqx/JQHiRdFV98YY5MoUmuIg8J://2WozIBx1Tx/36YiMCu
TLSH
T1A1A44B11775A98BDE449C474C30A86B36A2674CA0B26B9FF41D8A5383F79AF06F3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Discovers running processes 1 TTPs 30 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4296	tasklist.exe
4948	tasklist.exe
1840	tasklist.exe
5024	tasklist.exe
1560	tasklist.exe
2948	tasklist.exe
4520	tasklist.exe
4620	tasklist.exe
5112	tasklist.exe
4924	tasklist.exe
3500	tasklist.exe
4776	tasklist.exe
1936	tasklist.exe
4972	tasklist.exe
2552	tasklist.exe
2080	tasklist.exe
4008	tasklist.exe
1548	tasklist.exe
2932	tasklist.exe
2756	tasklist.exe
4612	tasklist.exe
4872	tasklist.exe
1452	tasklist.exe
4600	tasklist.exe
1544	tasklist.exe
2024	tasklist.exe
1092	tasklist.exe
1692	tasklist.exe
992	tasklist.exe
2124	tasklist.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	4972	tasklist.exe
Token: SeDebugPrivilege	4948	tasklist.exe
Token: SeDebugPrivilege	2552	tasklist.exe
Token: SeDebugPrivilege	1840	tasklist.exe
Token: SeDebugPrivilege	5024	tasklist.exe
Token: SeDebugPrivilege	1560	tasklist.exe
Token: SeDebugPrivilege	2948	tasklist.exe
Token: SeDebugPrivilege	1548	tasklist.exe
Token: SeDebugPrivilege	4520	tasklist.exe
Token: SeDebugPrivilege	4600	tasklist.exe
Token: SeDebugPrivilege	5112	tasklist.exe
Token: SeDebugPrivilege	1544	tasklist.exe
Token: SeDebugPrivilege	2024	tasklist.exe
Token: SeDebugPrivilege	2932	tasklist.exe
Token: SeDebugPrivilege	992	tasklist.exe
Token: SeDebugPrivilege	2124	tasklist.exe
Token: SeDebugPrivilege	1092	tasklist.exe
Token: SeDebugPrivilege	4620	tasklist.exe
Token: SeDebugPrivilege	2756	tasklist.exe
Token: SeDebugPrivilege	4924	tasklist.exe
Token: SeDebugPrivilege	2080	tasklist.exe
Token: SeDebugPrivilege	4612	tasklist.exe
Token: SeDebugPrivilege	4296	tasklist.exe
Token: SeDebugPrivilege	1692	tasklist.exe
Token: SeDebugPrivilege	4872	tasklist.exe
Token: SeDebugPrivilege	3500	tasklist.exe
Token: SeDebugPrivilege	1452	tasklist.exe
Token: SeDebugPrivilege	4776	tasklist.exe
Token: SeDebugPrivilege	4008	tasklist.exe
Token: SeDebugPrivilege	1936	tasklist.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 4972	5008	pulse-watchdog.exe	86
PID 5008 wrote to memory of 4948	5008	pulse-watchdog.exe	92
PID 5008 wrote to memory of 2552	5008	pulse-watchdog.exe	97
PID 5008 wrote to memory of 1840	5008	pulse-watchdog.exe	99
PID 5008 wrote to memory of 5024	5008	pulse-watchdog.exe	101
PID 5008 wrote to memory of 1560	5008	pulse-watchdog.exe	103
PID 5008 wrote to memory of 2948	5008	pulse-watchdog.exe	106
PID 5008 wrote to memory of 1548	5008	pulse-watchdog.exe	109
PID 5008 wrote to memory of 4520	5008	pulse-watchdog.exe	111
PID 5008 wrote to memory of 4600	5008	pulse-watchdog.exe	113
PID 5008 wrote to memory of 5112	5008	pulse-watchdog.exe	115
PID 5008 wrote to memory of 1544	5008	pulse-watchdog.exe	117
PID 5008 wrote to memory of 2024	5008	pulse-watchdog.exe	119
PID 5008 wrote to memory of 2932	5008	pulse-watchdog.exe	121
PID 5008 wrote to memory of 992	5008	pulse-watchdog.exe	123
PID 5008 wrote to memory of 2124	5008	pulse-watchdog.exe	125
PID 5008 wrote to memory of 1092	5008	pulse-watchdog.exe	127
PID 5008 wrote to memory of 4620	5008	pulse-watchdog.exe	129
PID 5008 wrote to memory of 2756	5008	pulse-watchdog.exe	131
PID 5008 wrote to memory of 4924	5008	pulse-watchdog.exe	133
PID 5008 wrote to memory of 2080	5008	pulse-watchdog.exe	135
PID 5008 wrote to memory of 4612	5008	pulse-watchdog.exe	137
PID 5008 wrote to memory of 4296	5008	pulse-watchdog.exe	139
PID 5008 wrote to memory of 1692	5008	pulse-watchdog.exe	141
PID 5008 wrote to memory of 4872	5008	pulse-watchdog.exe	143
PID 5008 wrote to memory of 3500	5008	pulse-watchdog.exe	145
PID 5008 wrote to memory of 1452	5008	pulse-watchdog.exe	147
PID 5008 wrote to memory of 4776	5008	pulse-watchdog.exe	149
PID 5008 wrote to memory of 4008	5008	pulse-watchdog.exe	151
PID 5008 wrote to memory of 1936	5008	pulse-watchdog.exe	153

C:\Users\Admin\AppData\Local\Temp\pulse-watchdog.exe
"C:\Users\Admin\AppData\Local\Temp\pulse-watchdog.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4972
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4948
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2552
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1840
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5024
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1560
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2948
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1548
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4520
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4600
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5112
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1544
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2024
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2932
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:992
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2124
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1092
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4620
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2756
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4924
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2080
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4612
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4296
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1692
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4872
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3500
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1452
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4776
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4008
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads