5a339451845a14a626ffa82356452bda69d5c7b9bab642c3d82d27a881fbe1e7

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 03:44

Target
2026-07-09_a67e3a81a89cb9ca02cebf420e3beb3c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 8.9MB
Sample260709-eamylact5n
SHA256 5a339451845a14a626ffa82356452bda69d5c7b9bab642c3d82d27a881fbe1e7
MD5 a67e3a81a89cb9ca02cebf420e3beb3c
SHA1 494d6e81a46649cad363e115f40fd7eb58f08b24
SHA512 6c88d8910e385c8b1317d9e9f77829a163f190ceb19496172bbcb71947be7ff441474f1d081eea90cbaa11aecd7ded5b2b0b6369097e9cf6712f194d1926bf78
SSDEEP 98304:/niAtsmu+k8PYchYEm4lBuZeVJGrqgss0+DlzEX:/D4WYA3BuZer1gss0
TLSH
T142967C03EC5564EAC1ADA2358AB79253BB71BC491B3223D71B90F6387E76BD0AD75300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 824	4324	2026-07-09_a67e3a81a89cb9ca02cebf420e3beb3c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	87
PID 4324 wrote to memory of 884	4324	2026-07-09_a67e3a81a89cb9ca02cebf420e3beb3c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-09_a67e3a81a89cb9ca02cebf420e3beb3c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_a67e3a81a89cb9ca02cebf420e3beb3c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\system32\cmd.exe
  cmd /c "color 16"
  2⤵
  PID:824
- C:\Windows\system32\cmd.exe
  cmd /c cls
  2⤵
  PID:884