f17b94ea7219951007cb268e47f175906b4e97a12a1b8658601c07b3ad90f4f4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 16:21

Target
2026-07-08_fbf4f20300ee48425f90e44265c4abc8_cobalt-strike_conti.exe
Size 330KB
Sample260708-tt5ebact3l
SHA256 f17b94ea7219951007cb268e47f175906b4e97a12a1b8658601c07b3ad90f4f4
MD5 fbf4f20300ee48425f90e44265c4abc8
SHA1 6fb7078a95825299ffa9b0d21b03f7eed567db01
SHA512 9ee868796badf63e2111c29eda6398cd661be50e75e5621c5c422212a34b17fca42092783d380b811b4f4f8af44c201269d2925392acfac0c400b7090d944d3d
SSDEEP 6144:8Rh1eza7ALFvWwGWiAPGS7BhVC0FYaSudCWikmBiaW8FyQva8MT2Y//:8Rh1e+V9Z6J7Xs0JBf8ImFFvX+/
TLSH
T189743B40B944FDF5DCCA8FB904F2131993EAA181D71DDA2F7910FE3C042AA58E97265B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 4676	4460	2026-07-08_fbf4f20300ee48425f90e44265c4abc8_cobalt-strike_conti.exe	86
PID 4676 wrote to memory of 2696	4676	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-08_fbf4f20300ee48425f90e44265c4abc8_cobalt-strike_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_fbf4f20300ee48425f90e44265c4abc8_cobalt-strike_conti.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c chcp 65001 > nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2696

memory/4460-0-0x0000000000400000-0x0000000000455000-memory.dmp

Download