f06c9db65691f55df0d78f3a53edd5bc0d187e1edf7a2c3dbd6e736d324947a5

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/06/2026, 12:19

Target
ude-usermode.exe
Size 236KB
Sample260621-phex3aes2x
SHA256 f06c9db65691f55df0d78f3a53edd5bc0d187e1edf7a2c3dbd6e736d324947a5
MD5 696ba267524ee9b4089d483b8053e4c2
SHA1 f28ad8e8eaf34556e808c070c0c933be4f7d98ff
SHA512 aa5f6412dae6c86c17b8d23f231a5ca6bf85e3ecb0e28e06b65e00955e17b1d909742a38c701196404d7371a022f1a078f3010ed2d79cefd4b3f7e9f27ec04d2
SSDEEP 6144:jr8UAhSDRvpnuSWO09wSB8cz3XZFOk39bW2:AYD/ne9z3pFfb
TLSH
T1B4347C17766518B9E96BD478CE939503EA333C454761EADF03E148A51F33EF0AA3A312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 3540	3780	ude-usermode.exe	89

C:\Users\Admin\AppData\Local\Temp\ude-usermode.exe
"C:\Users\Admin\AppData\Local\Temp\ude-usermode.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Windows\System32\tar.exe
  "C:\Windows\System32\tar.exe" -xf "C:\Users\Admin\AppData\Local\Temp\ude-driver-blocklist\VulnerableDriverBlockList.zip" -C "C:\Users\Admin\AppData\Local\Temp\ude-driver-blocklist" VulnerableDriverBlockList/DriverPolicy_Enforced.xml
  2⤵
  PID:3540

VulnerableDriverBlockList.zip

Path C:\Users\Admin\AppData\Local\Temp\ude-driver-blocklist\VulnerableDriverBlockList.zip
Size 325KB
SHA256 381e9c886c6f1b1eafe23597d5d92a538e69ac26f031f96ae07433acdae82b43
MD5 5f90184e02861d8121e7f7d9050d55a9
SHA1 05519f02e887b86f1569be1feeb6a42fd0fde0ee
SHA512 4adb6ca540ef649826eed2f1901f658aa6e75671706a6b79fb80a55ccc105cc96faea30dcdd82e01d60930a4bf6784a3d9e126738560e9828965df2939a6410e
SSDEEP 6144:zxqv8/YTUv2znkNgAN/ODDG4us6W3yfrF275musOetOmeN9RKsOetOmeN9Ry:AxYv2znkSAN74us6Ed5musw9XRKsw9XM
TLSH
T16D6422F147B46A9AF30E6438359741887283DC09E6F4EF63646A936B134FF71BB18816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DriverPolicy_Enforced.xml

Path C:\Users\Admin\AppData\Local\Temp\ude-driver-blocklist\VulnerableDriverBlockList\DriverPolicy_Enforced.xml
Size 531KB
SHA256 b772c4aacffac4130c36fc71c13f3b18b442a827887815417d211579e02f32e3
MD5 1e0ba1638f6c2e71278e8922dc66e02c
SHA1 4e63e6af892a4f44bb50d7cca05c8bf26e76ccf9
SHA512 f40dd92c4d208577d47754a02800c9581e093c323c3d422019a46d551c98092ae501789f6a43c2d3fa552d334056eb4689d71bc9021da5deef59542b62871856
SSDEEP 3072:kjng71RvhwwOAjck1QAR3m3+uxj/Ft/l0kL4NPQ70g6m2ms55kIJi+/qToroN:2nMmwT1QARKFt/lr4oog6m2mqkN
TLSH
T166C4FD6A20D87E162636A6759C2B42ECCA3002E7137F5221764D750B7FF309E897B6C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download