f697dea7fe17d8a7bae031624a7cd559d6040dd0d26192df8b1f2134c049ad08

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 18:43

Target
2026-07-08_0acdce2f3f952aadd242c80be66e1549_cobalt-strike_qilin_satacom.exe
Size 11KB
Sample260708-xdcadags2x
SHA256 f697dea7fe17d8a7bae031624a7cd559d6040dd0d26192df8b1f2134c049ad08
MD5 0acdce2f3f952aadd242c80be66e1549
SHA1 00053cb50f564b8446e355786b3e17e749b6bc60
SHA512 36da15dc6cf5a6a5dfd7bcaa4df18df6ba454b4cf6a3b2871b8844a8aeaa8e76958ed2810bc3cbd7d282d1ec8c12f8dc10fd0be28d427576d013d60928eb835f
SSDEEP 192:jo21CCYB5IXBchlJhEjUe4I3Q5tf8xFTi:BCCYPIRcBhEjV3d
TLSH
T1AC323A4DFA158CEAE9281378C5BB468DB076B722276147CB07A880392D123F5767B1CD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 4100	1372	2026-07-08_0acdce2f3f952aadd242c80be66e1549_cobalt-strike_qilin_satacom.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-08_0acdce2f3f952aadd242c80be66e1549_cobalt-strike_qilin_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_0acdce2f3f952aadd242c80be66e1549_cobalt-strike_qilin_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:4100