0422d184e8bdae44fd1daefc6e712fcad06295bbdc8d80565806c27e95be3e51

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
main/amdgpio3.sys
Size 32KB
Sample260804-xd26ssck4y
SHA256 0422d184e8bdae44fd1daefc6e712fcad06295bbdc8d80565806c27e95be3e51
MD5 86a0ac35353119bcf30a37473efe5555
SHA1 3adde4c4763f256b114daea67d35ed2614c3b66f
SHA512 fac45aeab430fe54790fccd5f27a45f9c75cfbb2ee325585211fe0fe1a297d8eaeb979700a6f528acbbf1de15959cdaeceb80d2d53521d105b40513f5ff33d11
SSDEEP 384:Bo/CvvVw0qFWx0L2KU+onoISBbPL3nVSonVqFRZ2lmTx4uImQSDDi7FRkcWwlTI9:BeCHVrqWwUxknVMNTVDDi/+GB
TLSH
T137E26CC19A7864C3EE839D7053E8EA977C38F3C31950841D11EAE5E50D83BD6BB1852E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2564	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main\amdgpio3.sys
1⤵
- Executes a command shell one-liner
PID:2564
- C:\Users\Admin\AppData\Local\Temp\main\amdgpio3.sys
  C:\Users\Admin\AppData\Local\Temp\main\amdgpio3.sys
  2⤵
  PID:124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/124-0-0x00007FF673BB0000-0x00007FF673BBA000-memory.dmp

Download