6fe6235523b29f3e0fa97ca492c2a00e27bc926cf9289836e826f03984515545

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hwdi changer v2.exe
Size 127KB
Sample260731-fp1cxada76
SHA256 6fe6235523b29f3e0fa97ca492c2a00e27bc926cf9289836e826f03984515545
MD5 044222226c9dc53ec33da0347cc84268
SHA1 1f19e0aead261717f4f40df7078786f2de330411
SHA512 5f3a8cc9ea83373cf8e07a3ae2c1142413d51516f144aa1523f5753370c12bb8b39596ba42a4b694868b1e8ae690954081f6cc06452ff60dbe995842397be7a5
SSDEEP 3072:M/25jvDSgsqsb5Uh28vAbTV1WW69B9VjMdxPedN9ug0z9TBfFSG4ZQ0:Ptzsb5Uh28+V1WW69B9VjMdxPedN9ugB
TLSH
T127D3389BB2E01189EBB581F6D5520786EB7074721711A3DB1B7863B71B2B8C58F3D3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3528	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 3528	912	hwdi changer v2.exe	90

C:\Users\Admin\AppData\Local\Temp\hwdi changer v2.exe
"C:\Users\Admin\AppData\Local\Temp\hwdi changer v2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\37B0.tmp\37B1.tmp\37B2.bat "C:\Users\Admin\AppData\Local\Temp\hwdi changer v2.exe""
  2⤵
  - Executes a command shell one-liner
  PID:3528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

37B2.bat

Path C:\Users\Admin\AppData\Local\Temp\37B0.tmp\37B1.tmp\37B2.bat
Size 5KB
SHA256 c3d72b092a341405380b35bb700c33c5e08ba9f3b9c3c354d56715974eab5655
MD5 ab5c6ca2491f3dbb57ec8e1a6797245b
SHA1 86eec90ce2c04a540350f5bb30ae874f6dacc5ad
SHA512 5818a66d4479b44e6e0edee4c59c86f8690f57375a9ad081faac2831ca3129d0fbee6f3ba302a381b19d95e4c4c3831e09aa119dd1da7691d4890f84a26e1c93
SSDEEP 48:lEBE9Gxr0AxqXBnXyR0yRWgvuaXyRnHyR7XaXyRnHyRofI9p/XyR3yR9O/6+DLnE:lS3xqUT2VVSxVVS2B0iS+S+Yhc3K
TLSH
T127B1E1107C4380590AB6D2758D54B417F2BB46C745131E98F78D80A23F73F9A3AF9ACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download