91e8c99a0439a890b5834cef1ae671cfbaa9a25f26b6330916487c33ce29b3ab

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 01:57

Target
2026-06-30_fc9c122b26acb5771cfb214e80b51d7b_cobalt-strike_icedid.exe
Size 224KB
Sample260701-cdrpvad19x
SHA256 91e8c99a0439a890b5834cef1ae671cfbaa9a25f26b6330916487c33ce29b3ab
MD5 fc9c122b26acb5771cfb214e80b51d7b
SHA1 8605a0faadb44832b7778623deb6e7690cb0c73a
SHA512 faef738f1c6fea65f833d8dc13cc95d6a69ae84fb961dca0f2b23ae82a3f22e384b4b296595546873899ce424df0f634e99eef4cfd54e4b8a176122427245923
SSDEEP 6144:V5/6qZROuoRqiY++++l/yvyi6jyOVBY1p8:V5ROuoYi5LOVB
TLSH
T19E24CF1B639A70FAEA7786788E544691E726B83103219FEF0366039D1F172E1DE39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 4304	672	2026-06-30_fc9c122b26acb5771cfb214e80b51d7b_cobalt-strike_icedid.exe	88
PID 672 wrote to memory of 4304	672	2026-06-30_fc9c122b26acb5771cfb214e80b51d7b_cobalt-strike_icedid.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-06-30_fc9c122b26acb5771cfb214e80b51d7b_cobalt-strike_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_fc9c122b26acb5771cfb214e80b51d7b_cobalt-strike_icedid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4304