68e81ce966ca0c016bb638d0d29b106a0da7eab2ddf70438d8182fa89baf5d78

Analysis

max time kernel
148s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
psl.exe
Size 64KB
Sample260825-wvb59sac92
SHA256 68e81ce966ca0c016bb638d0d29b106a0da7eab2ddf70438d8182fa89baf5d78
MD5 7a682a9da479baec38d5d43a02b604e9
SHA1 f47cfd3053fe916d078433a53c87010001de16ad
SHA512 acab4e8eb030b14f78119dbaf2dff58cffc11ff620c608fd0978653d6db7ac4bc0df93915c676af3bac0573587b15ba2b3707f83bdbc90d3e2fd16ef7b13df1d
SSDEEP 1536:dChgkRItz9QPtRg8NcMVPr8roUJqHWWbFE3rvzN:dcFt1S8NcMVPr8t0bFE75
TLSH
T1E3535C6AF34264EDD697C53491E69B71FA32B9110230AB3F725CE1301F31FA19E2A45E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdservices = "cmd /c start \"\" /D \"C:\\ProgramData\\winupdservices\" psl.exe"	psl.exe

Executes dropped EXE 2 IoCs

pid	Process
5068	DCRCVDrv.sys
4688	psl.exe

Loads dropped DLL 1 IoCs

pid	Process
4688	psl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 4688	4956	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\psl.exe
"C:\Users\Admin\AppData\Local\Temp\psl.exe"
1⤵
- Adds Run key to start application
PID:5536

C:\Windows\Temp\DCRCVDrv.sys
C:\Windows\Temp\DCRCVDrv.sys
1⤵
- Executes dropped EXE
PID:5068

C:\Windows\system32\cmd.exe
"cmd /c start "" /D "C:\ProgramData\winupdservices" psl.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\ProgramData\winupdservices\psl.exe
  "C:\ProgramData\winupdservices\psl.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4688
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:5160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

libiconv-2.dll

Path C:\ProgramData\winupdservices\libiconv-2.dll
Size 1.1MB
SHA256 2e5883a09cfc4391cb81db3f0da4d9b8cda21fc1b287e73a1624ad518d941b94
MD5 ba98508c9c8fb1681193aeffdbfa535e
SHA1 789489f95afe79a531373099336310707f0199ff
SHA512 992c8dba9e2a76bc8dfb2986d637c9005d8e607631dc7a9b5d16597b741421d3c287a1be27a885dfe360ce46e5f4b4b4282c18aa2f4582264ea285d993cf994e
SSDEEP 24576:fyRg1BAUZLY3wPKo6VbbTOZGavkg3NyeuQ6l9fH+ftFHo:6Rg1BAUZLYgio6IZGaXBuQQ9etFI
TLSH
T10535BE51F3D2CB2BF263C6B0C9AA5B26E427EC216B0645337660B3BC5D33BA415C8566
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libidn2-0.dll

Path C:\ProgramData\winupdservices\libidn2-0.dll
Size 251KB
SHA256 3ebaf0f048ad557c789c7602bbf0ff878b4e1c84b27fac559ad72c72259bd90e
MD5 a356b7276a9d7e05a7a6e277b371c44b
SHA1 d77d7b5584a73b9e5bbecba60a886edcf5d3d8d5
SHA512 58fa422b4d9049ea3b08a2e4e7b5065086f2cc833fce581cc7135b22369a8cc4c399d4c9821e1f33dcc468ce06376dfa852efe25921d7671d5e2c9c598cc9cd1
SSDEEP 6144:41G+RUwUos/HQQqBsDwSs4m/ukDyB9pKw:2GIUwUd/wynWyB9pKw
TLSH
T132447C22FFC358BAE8BBC231A4874731A7A2BC012615DF5B5318FE287C326F54D65219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libintl-8.dll

Path C:\ProgramData\winupdservices\libintl-8.dll
Size 301KB
SHA256 a62094d6e21670f460cb110389d2cb7b9bc12cfbb075151eeb2c52436cc02755
MD5 83f4bfec7f089f4a9efd5b36690b6cd7
SHA1 8f9b913c8c4724c70eddab906fb1465e4fcb0dbf
SHA512 43a4049e6ca85b90fe9b325b301b6c23d94d2045e0b218b0d0495c539ec22c6f43b2f4fd589b77b3945d0f9f2938e84db9c534aeb79fa5b929102b0c6eeeb20e
SSDEEP 6144:DqvWcwWaX1Ziu21y+7DE4a0onJMFEdd+TuoJB:6WcOXow+8Wmiwd+TuoJB
TLSH
T11C642907B24395D9E153D5308987C7F5B973BC720BA0AAB726A0F33C2E329515B19B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libpsl-5.dll

Path C:\ProgramData\winupdservices\libpsl-5.dll
Size 5.4MB
SHA256 85c60e58e827d88421e0c3647da9897d33af13f436678df7f4ed433610760052
MD5 e3d538692c3578e119a03f302ca1b1ce
SHA1 90e11f3ff521c0bd82368b6a505d9c9cfdab9f57
SHA512 1fa8011ea7718e76adde3739fbb88f11f06333285220be952f7855fd2bd71dd68f93efd2b6819033d0aa0d6ace0bf4ad6e567ceb415916fd63ff8dd76cadef89
SSDEEP 98304:0N0Xp/C9YEE7720ku0JsZzcGdum8Zb6+65Z:0N0XqYEE772sdZzcGzT+0
TLSH
T169468C4F73876AADC016C535D617B632C162F8220B7581CBA996E6FE1E73B804E3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libunistring-5.dll

Path C:\ProgramData\winupdservices\libunistring-5.dll
Size 2.1MB
SHA256 35eae7305e2e108ec3eac677f3357e376247e77e32aaecbf818b2c68f134d91c
MD5 c7c2ad785d5cd588ffbc7287a7a32f57
SHA1 dcc9c1e21dbfc14e26574d024bde379aec839160
SHA512 d07bd5d3b5600d97624a0f8fba46754000a5c9ae9a346b1171a7cdf7efcb38a7569798b0f2b8a4378530a8824c8f9a1e24f95e47c76c633ced04a1a8861faef9
SSDEEP 49152:aFIJ3c3285Qfix+WoXHd6PFbE6QTVpIyd5F3dB:a+J365Qf93l6QD5F3dB
TLSH
T166A56A16B11FD3D8F5C9C4304E8EFBB291517C29ADA0A67FB650F32D1D3A8E74A09126
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

psl.exe

Path C:\ProgramData\winupdservices\psl.exe
Size 64KB
SHA256 68e81ce966ca0c016bb638d0d29b106a0da7eab2ddf70438d8182fa89baf5d78
MD5 7a682a9da479baec38d5d43a02b604e9
SHA1 f47cfd3053fe916d078433a53c87010001de16ad
SHA512 acab4e8eb030b14f78119dbaf2dff58cffc11ff620c608fd0978653d6db7ac4bc0df93915c676af3bac0573587b15ba2b3707f83bdbc90d3e2fd16ef7b13df1d
SSDEEP 1536:dChgkRItz9QPtRg8NcMVPr8roUJqHWWbFE3rvzN:dcFt1S8NcMVPr8t0bFE75
TLSH
T1E3535C6AF34264EDD697C53491E69B71FA32B9110230AB3F725CE1301F31FA19E2A45E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DCRCVDrv.sys

Path C:\Windows\Temp\DCRCVDrv.sys
Size 137KB
SHA256 87e8d39db624f37d3e77aedf487a2dfd197f71a4730ea74f4e7a4341deaec2ff
MD5 567c158ee0858f8e941d4ab7a6c18dbc
SHA1 47d922b0fd5d704025d14ef98ded46e74830a423
SHA512 f976cb8e9a2f0fc769e2e4345d18e1e9f01fdb1c4303eb20d94b625467e60ce20dd120e77a96d9ba498361dd6dc0066535404cb22cf99fc49607d1f35eaed2ab
SSDEEP 3072:6pEFTp46B6ETbeP/ItLK9Di8/4BQaeJzP:Y8Tp46B6EOLgBQX
TLSH
T10CD33A12A36550A4E977E2B8C6B65263EFF37861133547CF03608A654F23BE4B93A3D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4688-20-0x00007FF6B3B50000-0x00007FF6B3B65000-memory.dmp

Download

memory/5068-2-0x0000000000010000-0x000000000003D000-memory.dmp

Download

memory/5536-9-0x00007FF6C9130000-0x00007FF6C9145000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads