63c128dcb78f5ea819596b684e596f4d43be3178ea3f5c58800eba9e1d008d40

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/08/2026, 04:28

Target
file.exe
Size 2.2MB
Sample260829-e3rr9awdqe
SHA256 63c128dcb78f5ea819596b684e596f4d43be3178ea3f5c58800eba9e1d008d40
MD5 92fbea8a8e0f5dec6269c1f00e08236e
SHA1 32709b04f7994c96545c42fb3402b7479fea8543
SHA512 36398e8e11fc445f30ad215af8f771dbb13618587f92af5c906841ab2b63b0968cd62151bbe34c306cc423917957436c9efa0a746ba82c62dc409f64eecb8690
SSDEEP 49152:oOUgKnTfeVkyKiuzBNpNmoLxDXo1ydvKMAGrFAyB:03Tg+1NmMxXo1eKIJxB
TLSH
T126B58CB24B57E263C8080935332CDEBC2D02E9A7237172D036D76FAD21E15ED9676AD1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2844	id8nm1wfax.sys

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	1680	file.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2672	1680	file.exe	84

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -s -L --connect-timeout 10 --max-time 120 --retry 1 -A Microsoft-Symbol-Server/10.1700.661.0 -o "C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.pdb" "https://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/CA8E2F01B822EDE6357898BFBF8629971/ntkrnlmp.pdb"
  2⤵
  PID:2672

C:\Users\Admin\AppData\Local\Temp\id8nm1wfax.sys
C:\Users\Admin\AppData\Local\Temp\id8nm1wfax.sys
1⤵
- Executes dropped EXE
PID:2844

id8nm1wfax.sys

Path C:\Users\Admin\AppData\Local\Temp\id8nm1wfax.sys
Size 78KB
SHA256 6e8b49cf70bf854e8c59c7d27cefa89406caf8978461190dabb86dafcd8554e1
MD5 b96d75a000367c200958089728fc5cb8
SHA1 f329ae0fdf1e198bea6ba787e59cb73f90714002
SHA512 60fb02287aff7b7d7b7057be6f0a828c702a0ba9653fd4079d0e5bea3b476dc06cae4f27292684c9235ed21a498403bbf4bc6609c0d9c3c2de920e981ef1df17
SSDEEP 1536:Qn8/+PtpHLPxNn1szNYeYVxRqx+g1JOE7ubt6INPXWmT6A5+KA:5/yTxNKOesx8xIh6AGLA5I
TLSH
T1C173E0D1162CA4C2ED879D31A2C8D623BC70B3911E62D6F391A5D1790E867C16F2C9AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntkrnlmp.pdb

Path C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.pdb
Size 8.2MB
SHA256 e1be7b013e71142ebfb160edead2642bf0e632a9e714540555aea2de9c23e90a
MD5 53c9a74200005b59e327f1bfb5e54723
SHA1 1b0a06b5ba246846277718332d9df61018feaa8a
SHA512 fcf3adb46e408522fbd424feb5d3ddb015588614e2986f0dca1a2e2b0d739be5a4fd764664454ad64c41a22af4484a0fc05b42d8a4552a5e3bb76d1d0449b21b
SSDEEP 49152:lHqZ7pecPpUFnQ/6/NBSOLKQCmtN4fReM/pclAoCIZ99e:liAcuv0d/KE
TLSH
T1CC861815BA83BEF6CD4A437FA022032DF7F296C5039947E77446B2A52DC26119FAE341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download