43acd1c717dee1278b21999d9041faa41ec2bcf111804bb0d1b8ce880dd6adee

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 08:42

Target
2026-07-07_02c3f1c969e4990f797a4adf4ac98a41_cobalt-strike_icedid_satacom.exe
Size 107KB
Sample260707-kmbc8ad16w
SHA256 43acd1c717dee1278b21999d9041faa41ec2bcf111804bb0d1b8ce880dd6adee
MD5 02c3f1c969e4990f797a4adf4ac98a41
SHA1 beb7ca34d385637a56b7fb46c832ad1b646b332e
SHA512 f54a8c5773775cf7777dba3d3c5d28d66095dad4357bd5579c61623ba9b1647797e8081943b57bd670d3ef15e5d5fdedaf93b7d548d7510bad2004a8080a10ca
SSDEEP 3072:uR1TtNuLR7EjRmG4aXIlIwyIgwQ9irXVaN:SNuV7E1qlIZn
TLSH
T10CB35A5BA3A530F9F077867C84910A46E776B83107618FFF03A842596F236D58D3AF60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 748	4524	2026-07-07_02c3f1c969e4990f797a4adf4ac98a41_cobalt-strike_icedid_satacom.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-07_02c3f1c969e4990f797a4adf4ac98a41_cobalt-strike_icedid_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_02c3f1c969e4990f797a4adf4ac98a41_cobalt-strike_icedid_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:748

memory/4524-0-0x0000023D69B30000-0x0000023D69B31000-memory.dmp

Download

memory/4524-1-0x0000023D69B30000-0x0000023D69B31000-memory.dmp

Download