c9ff9a1c70d0326468eebfb6c6edfe5dc7350a9e79c3c3e14d7f93b0893c3565

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 12:19

Target
libpsl-5.dll
Size 2.4MB
Sample260629-pg6dmac16v
SHA256 c9ff9a1c70d0326468eebfb6c6edfe5dc7350a9e79c3c3e14d7f93b0893c3565
MD5 75a46879fdb6d4f9c32b504e2f97f5ab
SHA1 e0892f01bd81e1a78fc99d914f96f9ab7b56d662
SHA512 0161051a1bf4eec30f1ed0d3bc2511f7b417e3a96e5ead4c0721b6bb70b3dffdef4b827bd5d1e7f7281b27df883a7f1f7812437fee208b622a12e700334fde07
SSDEEP 49152:8310VYDRmvl+BnBjQ8GBCnDXepZjtXIH/C3uDuG5fw8QJXAYnq9a26mCa5caDGQ7:IsZ+BvOZjtXIH/C3uDuG5fw8QJXAYnqN
TLSH
T1A5B5AF56B3C45AAAD116C93987179232C272BC524776D2CBAE96E70E1F77F804F39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4128	DCRCVDrv.sys

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
812	Process not Found

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libpsl-5.dll,#1
1⤵
PID:2612

C:\Windows\Temp\DCRCVDrv.sys
C:\Windows\Temp\DCRCVDrv.sys
1⤵
- Executes dropped EXE
PID:4128

DCRCVDrv.sys

Path C:\Windows\Temp\DCRCVDrv.sys
Size 137KB
SHA256 87e8d39db624f37d3e77aedf487a2dfd197f71a4730ea74f4e7a4341deaec2ff
MD5 567c158ee0858f8e941d4ab7a6c18dbc
SHA1 47d922b0fd5d704025d14ef98ded46e74830a423
SHA512 f976cb8e9a2f0fc769e2e4345d18e1e9f01fdb1c4303eb20d94b625467e60ce20dd120e77a96d9ba498361dd6dc0066535404cb22cf99fc49607d1f35eaed2ab
SSDEEP 3072:6pEFTp46B6ETbeP/ItLK9Di8/4BQaeJzP:Y8Tp46B6EOLgBQX
TLSH
T10CD33A12A36550A4E977E2B8C6B65263EFF37861133547CF03608A654F23BE4B93A3D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4128-2-0x0000000000010000-0x000000000003D000-memory.dmp

Download