3921e79869c5115a78caf275e106676d6642c5e121c95012eaa5a9771966c0fd

Analysis

max time kernel
148s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 17:44

Target
2026-07-08_6d75d8a7eb0912cfb23379f7056d6f06_cobalt-strike_conti.exe
Size 330KB
Sample260708-wa7rfaez4x
SHA256 3921e79869c5115a78caf275e106676d6642c5e121c95012eaa5a9771966c0fd
MD5 6d75d8a7eb0912cfb23379f7056d6f06
SHA1 8f4767d8e0cd92723a07c009f9cd0490d3f237b8
SHA512 762c6ffd590af5167216a11982029bca7ce713c56ea4fea278c48cf9cd97f3e03787ea5ab0f1926d299e4cad0f384206cab848beaf245452a8893e2428f3e7bb
SSDEEP 6144:mQkmza7AL1vWwGFiAPGS7BhVC0sXakudSWiJmsiagFYQva89TmwO/:jkm+F9U6J7Xs0NXTvDFFXvXs/
TLSH
T10F743C40B544FDF5DCCA8FB904F2131993EAA181D71DDA2F7920FE3C042AA58E97265B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 5884	972	2026-07-08_6d75d8a7eb0912cfb23379f7056d6f06_cobalt-strike_conti.exe	89
PID 5884 wrote to memory of 3196	5884	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-08_6d75d8a7eb0912cfb23379f7056d6f06_cobalt-strike_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_6d75d8a7eb0912cfb23379f7056d6f06_cobalt-strike_conti.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c chcp 65001 > nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5884
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3196

memory/972-0-0x0000000000400000-0x0000000000455000-memory.dmp

Download