d82108e6578f4866d7114d6847282c04f0b146809bc66ded3300fe993b42d20f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CVE-2026-36425-main/Drivers/ardrv_15.sys
Size 16KB
Sample260802-enppcacg86
SHA256 d82108e6578f4866d7114d6847282c04f0b146809bc66ded3300fe993b42d20f
MD5 50390455e92fb62cbe6a89dbb61037c2
SHA1 b02ad9271e5410dfd7edd03d50469997ea54a8b2
SHA512 f6dac88336489b81361eae5c47caadfb182c55213af51fc7d9fc6132380be9de8a06b598a1027b7c17952657bc0a334ef68a40284452e127290fd13536f4b31e
SSDEEP 192:fvuYacCCpQIw9l0Hvs0MI1xaTnYe+PjP8srcQqwBjtlAO5gXUE:3uoCCpQIY0Hvs0MqaTnYPL1tqOUO5gz
TLSH
T14A723B8B471930AAFAD7CA75D2B6867BEC30BAD0A76605FF0165C1910E81FE05B3D319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3036	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\CVE-2026-36425-main\Drivers\ardrv_15.sys
1⤵
- Executes a command shell one-liner
PID:3036
- C:\Users\Admin\AppData\Local\Temp\CVE-2026-36425-main\Drivers\ardrv_15.sys
  C:\Users\Admin\AppData\Local\Temp\CVE-2026-36425-main\Drivers\ardrv_15.sys
  2⤵
  PID:4752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4752-0-0x0000000000010000-0x0000000000017000-memory.dmp

Download