4cdc6cbbe9adef692fdea16ac3ec3879fd764f13840f8e92fde80d40ab8e64eb

Analysis

user interaction
yes
max time kernel
48s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/06/2026, 12:19

Target
ude-driver.zip
Size 162KB
Sample260621-phex3aes2x
SHA256 4cdc6cbbe9adef692fdea16ac3ec3879fd764f13840f8e92fde80d40ab8e64eb
MD5 dd1768cbb43ce59b3e841d3333426215
SHA1 f76909bd69ed76e931dff9a6142427ff1734f457
SHA512 2c332b02f2586744057f044220ac5bddeb41bd51ed444fc76102899da2c3dbf8b3f73064b99e1bc2bcf366702de8fa432ea756a82dbd5e075c79f85ca1d53048
SSDEEP 3072:vBgR8k/rLGYJIdCHo8NALUKKI7TqtpfbQ4tYGlXeHf/Us:GR8kDmcoCUUnIXypDQ4tYN/j
TLSH
T1AFF312906CFD5DE200317439D35F94967B483EF8794CEA8CE306AA4B219F87533961CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1872	ude-usermode.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 1424	1872	ude-usermode.exe	111

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\ude-driver.zip
1⤵
PID:1064

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1796

C:\Users\Admin\Desktop\ude-driver\ude-usermode.exe
"C:\Users\Admin\Desktop\ude-driver\ude-usermode.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\System32\tar.exe
  "C:\Windows\System32\tar.exe" -xf "C:\Users\Admin\AppData\Local\Temp\ude-driver-blocklist\VulnerableDriverBlockList.zip" -C "C:\Users\Admin\AppData\Local\Temp\ude-driver-blocklist" VulnerableDriverBlockList/DriverPolicy_Enforced.xml
  2⤵
  PID:1424

VulnerableDriverBlockList.zip

Path C:\Users\Admin\AppData\Local\Temp\ude-driver-blocklist\VulnerableDriverBlockList.zip
Size 325KB
SHA256 381e9c886c6f1b1eafe23597d5d92a538e69ac26f031f96ae07433acdae82b43
MD5 5f90184e02861d8121e7f7d9050d55a9
SHA1 05519f02e887b86f1569be1feeb6a42fd0fde0ee
SHA512 4adb6ca540ef649826eed2f1901f658aa6e75671706a6b79fb80a55ccc105cc96faea30dcdd82e01d60930a4bf6784a3d9e126738560e9828965df2939a6410e
SSDEEP 6144:zxqv8/YTUv2znkNgAN/ODDG4us6W3yfrF275musOetOmeN9RKsOetOmeN9Ry:AxYv2znkSAN74us6Ed5musw9XRKsw9XM
TLSH
T16D6422F147B46A9AF30E6438359741887283DC09E6F4EF63646A936B134FF71BB18816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DriverPolicy_Enforced.xml

Path C:\Users\Admin\AppData\Local\Temp\ude-driver-blocklist\VulnerableDriverBlockList\DriverPolicy_Enforced.xml
Size 531KB
SHA256 b772c4aacffac4130c36fc71c13f3b18b442a827887815417d211579e02f32e3
MD5 1e0ba1638f6c2e71278e8922dc66e02c
SHA1 4e63e6af892a4f44bb50d7cca05c8bf26e76ccf9
SHA512 f40dd92c4d208577d47754a02800c9581e093c323c3d422019a46d551c98092ae501789f6a43c2d3fa552d334056eb4689d71bc9021da5deef59542b62871856
SSDEEP 3072:kjng71RvhwwOAjck1QAR3m3+uxj/Ft/l0kL4NPQ70g6m2ms55kIJi+/qToroN:2nMmwT1QARKFt/lr4oog6m2mqkN
TLSH
T166C4FD6A20D87E162636A6759C2B42ECCA3002E7137F5221764D750B7FF309E897B6C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download