37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba

Analysis

max time kernel
898s
max time network
430s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 12:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/DmiEdit/amifldrv64.sys
Size 18KB
Sample261102-p77pdatwht
SHA256 37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba
MD5 785045f8b25cd2e937ddc6b09debe01a
SHA1 029c678674f482ababe8bbfdb93152392457109d
SHA512 40bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9
SSDEEP 384:Cf8OVN6UDYm+b10HMHd6xhxuGZBBfSZsHLPK6jz/cf:CffV8KApCMMxDuIPKgwf
TLSH
T1EE922911C3A45C4AEEA7CA3571F89636BE31B95177B4CADF8111C0068BA2BE15A7C368
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1876	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Pumpkhn_UnhwidBan\Unhwidban\hwid\FIles\DmiEdit\amifldrv64.sys
1⤵
- Executes a command shell one-liner
PID:1876
- C:\Users\Admin\AppData\Local\Temp\Pumpkhn_UnhwidBan\Unhwidban\hwid\FIles\DmiEdit\amifldrv64.sys
  C:\Users\Admin\AppData\Local\Temp\Pumpkhn_UnhwidBan\Unhwidban\hwid\FIles\DmiEdit\amifldrv64.sys
  2⤵
  PID:5152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5152-0-0x0000000000010000-0x0000000000017000-memory.dmp

Download