744014a791c07cf3b9387adecb94552d8b6ac523433f7063411198509155f3e9

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CDM 2.04.16 WHQL Certified/amd64/ftdibus.sys
Size 67KB
Sample261027-ec1mga1vbw
SHA256 744014a791c07cf3b9387adecb94552d8b6ac523433f7063411198509155f3e9
MD5 82d4bd620f7e27ea268ea0e2f701a7ae
SHA1 65c4b5ef396660231db0fd315e7a1113306aeba0
SHA512 ae837b558a5f908fa199100a6563f74b9018a5f3729274bd0a806ec819264e0a80548befc7d4b0533753f43ced626660b7792ece574c8b666d76ac87641b937e
SSDEEP 1536:jfgVv+jLA1jnXZTOkgAqxfnKPcpjUyA4sJDcNSZ0JC3g:8Vv+jMVXtOOqlhCJDcSZ0JC
TLSH
T101636D5686F70589D8B6C97AC2D74537EFB1F8401B650FDF02A18A994F13BF06A39322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4600	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\CDM 2.04.16 WHQL Certified\amd64\ftdibus.sys"
1⤵
- Executes a command shell one-liner
PID:4600
- C:\Users\Admin\AppData\Local\Temp\CDM 2.04.16 WHQL Certified\amd64\ftdibus.sys
  "C:\Users\Admin\AppData\Local\Temp\CDM 2.04.16 WHQL Certified\amd64\ftdibus.sys"
  2⤵
  PID:5456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5456-0-0x0000000000010000-0x000000000001F900-memory.dmp

Download