a9b42fc6f6235ce6cd66b798e780da091d847fd4c6009a4802fde2300c99017b

Analysis

max time kernel
149s
max time network
134s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 01:39

Target
2026-05-29_2d8915e7dd71914fa65cf350382cbdb9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 796KB
Sample260529-b2ymmahs7w
SHA256 a9b42fc6f6235ce6cd66b798e780da091d847fd4c6009a4802fde2300c99017b
MD5 2d8915e7dd71914fa65cf350382cbdb9
SHA1 b19c4b609b90b97440a8adb26aa837ea7825e966
SHA512 7f47fde8fbc90990033787e0fd7d9d084a444281027b524dd2e5a4cdbdd69f561b7f8dada806be097c8513c490b0b9891cd61ce4ad3688c3802e20a84f3c2d53
SSDEEP 12288:90n+dXZSjjZGmCSJrjX6rqqFrJwRUFGnzf1P0hGAlTsOns6wlnQQo/da:SqSjj0SJX6r6zf1PcGoTsllnH
TLSH
T13E05BF45B6F901F9C033A138D956B607EA767C09072096DF23E44A6D2F637E07A7B722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 4936	1260	2026-05-29_2d8915e7dd71914fa65cf350382cbdb9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-29_2d8915e7dd71914fa65cf350382cbdb9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-29_2d8915e7dd71914fa65cf350382cbdb9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\system32\rundll32.exe
  C:\Windows\system32\rundll32.exe --HOLLOWED_RUNTIME
  2⤵
  PID:4936