4d07b6423f4d5d80d2daec8faed7ecc40855339bee95c26289179c1fd083078e

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CVE-2026-36425-main/Drivers/ardrv_3.sys
Size 16KB
Sample260802-enppcacg86
SHA256 4d07b6423f4d5d80d2daec8faed7ecc40855339bee95c26289179c1fd083078e
MD5 a21bc9c04bd840d655bfcd274cc84e40
SHA1 da57a16315d9e9c7bd426cc69bbb0427874b52d7
SHA512 8f66e04fe5820551aeb0059d313009a4e479dad9702ab1c658747fbf44a6070848e98a845e74b154fc41b8633e3b3af2b42ba51a16af1d1a696b87908b346091
SSDEEP 192:wvuYacCCpQIw9l0H7os0GxxuSnYe+PjP8srcQqwBjtlA1U18U:cuoCCpQIY0H7os08uSnYPL1tqOU1UR
TLSH
T111724B8A4729709AFAD7CE75C2B6826BEC31FAD0B75605FF0159C1911D82FE05B3E209
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2776	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\CVE-2026-36425-main\Drivers\ardrv_3.sys
1⤵
- Executes a command shell one-liner
PID:2776
- C:\Users\Admin\AppData\Local\Temp\CVE-2026-36425-main\Drivers\ardrv_3.sys
  C:\Users\Admin\AppData\Local\Temp\CVE-2026-36425-main\Drivers\ardrv_3.sys
  2⤵
  PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4432-0-0x0000000000010000-0x0000000000017000-memory.dmp

Download