ba3b2a594aa2552f255b1ce5b02ddd687374306c9657ed06a38c6d6d6338d441

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pulse-watchdog.exe
Size 442KB
Sample261017-hf1cnaythy
SHA256 ba3b2a594aa2552f255b1ce5b02ddd687374306c9657ed06a38c6d6d6338d441
MD5 1f618f5bb4975ff9a0bcdf2bf8d3859a
SHA1 39527e12ad5bef8f15c184faf53743c59d3829c5
SHA512 e40dbff81a4c0b25d397a41644508923a9ada483a36e6ec93bf785f35068d1006299f41d644cd8b062c9a1a44b2c1f5d6217bc7feb944b99643322c732486be5
SSDEEP 6144:WM/VIWCzB+NOjMoiAZA51Cqx/JQHiRdFV98YY5MoUmuIg8J://2WozIBx1Tx/36YiMCu
TLSH
T1A1A44B11775A98BDE449C474C30A86B36A2674CA0B26B9FF41D8A5383F79AF06F3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Discovers running processes 1 TTPs 29 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4784	tasklist.exe
5900	tasklist.exe
500	tasklist.exe
4420	tasklist.exe
5044	tasklist.exe
2580	tasklist.exe
896	tasklist.exe
4232	tasklist.exe
4164	tasklist.exe
5148	tasklist.exe
5596	tasklist.exe
860	tasklist.exe
4944	tasklist.exe
5568	tasklist.exe
5248	tasklist.exe
2612	tasklist.exe
5840	tasklist.exe
3668	tasklist.exe
3472	tasklist.exe
2300	tasklist.exe
2800	tasklist.exe
2184	tasklist.exe
4720	tasklist.exe
1324	tasklist.exe
2348	tasklist.exe
4108	tasklist.exe
6108	tasklist.exe
5112	tasklist.exe
2216	tasklist.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	6108	tasklist.exe
Token: SeDebugPrivilege	3668	tasklist.exe
Token: SeDebugPrivilege	4232	tasklist.exe
Token: SeDebugPrivilege	5568	tasklist.exe
Token: SeDebugPrivilege	3472	tasklist.exe
Token: SeDebugPrivilege	5248	tasklist.exe
Token: SeDebugPrivilege	500	tasklist.exe
Token: SeDebugPrivilege	2800	tasklist.exe
Token: SeDebugPrivilege	2612	tasklist.exe
Token: SeDebugPrivilege	5112	tasklist.exe
Token: SeDebugPrivilege	4164	tasklist.exe
Token: SeDebugPrivilege	4420	tasklist.exe
Token: SeDebugPrivilege	2216	tasklist.exe
Token: SeDebugPrivilege	896	tasklist.exe
Token: SeDebugPrivilege	2300	tasklist.exe
Token: SeDebugPrivilege	5044	tasklist.exe
Token: SeDebugPrivilege	5148	tasklist.exe
Token: SeDebugPrivilege	2184	tasklist.exe
Token: SeDebugPrivilege	4720	tasklist.exe
Token: SeDebugPrivilege	5596	tasklist.exe
Token: SeDebugPrivilege	1324	tasklist.exe
Token: SeDebugPrivilege	4784	tasklist.exe
Token: SeDebugPrivilege	2580	tasklist.exe
Token: SeDebugPrivilege	5840	tasklist.exe
Token: SeDebugPrivilege	2348	tasklist.exe
Token: SeDebugPrivilege	5900	tasklist.exe
Token: SeDebugPrivilege	4108	tasklist.exe
Token: SeDebugPrivilege	860	tasklist.exe
Token: SeDebugPrivilege	4944	tasklist.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 6108	5084	pulse-watchdog.exe	90
PID 5084 wrote to memory of 3668	5084	pulse-watchdog.exe	93
PID 5084 wrote to memory of 4232	5084	pulse-watchdog.exe	95
PID 5084 wrote to memory of 5568	5084	pulse-watchdog.exe	97
PID 5084 wrote to memory of 3472	5084	pulse-watchdog.exe	99
PID 5084 wrote to memory of 5248	5084	pulse-watchdog.exe	101
PID 5084 wrote to memory of 500	5084	pulse-watchdog.exe	104
PID 5084 wrote to memory of 2800	5084	pulse-watchdog.exe	106
PID 5084 wrote to memory of 2612	5084	pulse-watchdog.exe	108
PID 5084 wrote to memory of 5112	5084	pulse-watchdog.exe	110
PID 5084 wrote to memory of 4164	5084	pulse-watchdog.exe	112
PID 5084 wrote to memory of 4420	5084	pulse-watchdog.exe	114
PID 5084 wrote to memory of 2216	5084	pulse-watchdog.exe	116
PID 5084 wrote to memory of 896	5084	pulse-watchdog.exe	118
PID 5084 wrote to memory of 2300	5084	pulse-watchdog.exe	120
PID 5084 wrote to memory of 5044	5084	pulse-watchdog.exe	122
PID 5084 wrote to memory of 5148	5084	pulse-watchdog.exe	124
PID 5084 wrote to memory of 2184	5084	pulse-watchdog.exe	126
PID 5084 wrote to memory of 4720	5084	pulse-watchdog.exe	128
PID 5084 wrote to memory of 5596	5084	pulse-watchdog.exe	130
PID 5084 wrote to memory of 1324	5084	pulse-watchdog.exe	132
PID 5084 wrote to memory of 4784	5084	pulse-watchdog.exe	134
PID 5084 wrote to memory of 2580	5084	pulse-watchdog.exe	136
PID 5084 wrote to memory of 5840	5084	pulse-watchdog.exe	138
PID 5084 wrote to memory of 2348	5084	pulse-watchdog.exe	140
PID 5084 wrote to memory of 5900	5084	pulse-watchdog.exe	142
PID 5084 wrote to memory of 4108	5084	pulse-watchdog.exe	144
PID 5084 wrote to memory of 860	5084	pulse-watchdog.exe	146
PID 5084 wrote to memory of 4944	5084	pulse-watchdog.exe	148

C:\Users\Admin\AppData\Local\Temp\pulse-watchdog.exe
"C:\Users\Admin\AppData\Local\Temp\pulse-watchdog.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:6108
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3668
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4232
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5568
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3472
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5248
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:500
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2800
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2612
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5112
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4164
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4420
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:896
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2300
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5044
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5148
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2184
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4720
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5596
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1324
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4784
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2580
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5840
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2348
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5900
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4108
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:860
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq pulse.exe" /NH /FO CSV
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads