bdb107d7eea2a0e77db9439c0a1d5e770d0b59c01c64c833e2cc1da80ad1be8b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
msdv.sys
Size 45KB
Sample260720-ebyfqagz81
SHA256 bdb107d7eea2a0e77db9439c0a1d5e770d0b59c01c64c833e2cc1da80ad1be8b
MD5 348a7f225eb0253da62ec098bf19fa08
SHA1 6305094f100b95897d103cbda8cb435c7b4e9215
SHA512 802bcd03350bc0f7fa861c587efa22ac3d2a5f9fd4a27085fac78ddd1b8b42c5cec840e0a40fb8cb438be8bcaeeed654657ac26cc58dd842aeca81f7a851b461
SSDEEP 384:cCOT2GNkxNwcLPYSVaZUjBCq2Lj0bUmsVmaVDrOR/BLQjB6IVcvFlQ0WJGEWs:pKCpL5au2LrMODrOFBLQ96IV6MS+
TLSH
T12E236C01B790C871C11142B08E9BA3F467F7B6265F2AA76373B4572F1F39250BE616A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4804	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\msdv.sys
1⤵
- Executes a command shell one-liner
PID:4804
- C:\Users\Admin\AppData\Local\Temp\msdv.sys
  C:\Users\Admin\AppData\Local\Temp\msdv.sys
  2⤵
  PID:3300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3300-0-0x0000000000010000-0x000000000001B400-memory.dmp

Download