cb9f11978b70587db5adc63bc7bc198cf08503568323fa25ff2fa05a5f94cfd3

Analysis

max time kernel
148s
max time network
3s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 21:58

Target
2026-07-10_c8e0b63569d5860addaf16d6a4b5cb4b_cobalt-strike_glassworm_icedid_vidar.exe
Size 4.3MB
Sample260710-1vp5caes2w
SHA256 cb9f11978b70587db5adc63bc7bc198cf08503568323fa25ff2fa05a5f94cfd3
MD5 c8e0b63569d5860addaf16d6a4b5cb4b
SHA1 10205a3f5d173d32d2f697264ea59d6b9b97d13f
SHA512 2b41d953a193194b58f5877b048779fe3bfa111779cbe89c48f517b6055d1fac28714989c1486fae7b01da4077720ab6cadbead1bf0393424b7e7391262d71d6
SSDEEP 98304:eDBlqjdKnVbZmEZLgz/nccN5cZuYujEEnVbZmEjLgzHnEz45cjuVIjf1fVbZmEXd:eDBMjobZmERgz/ncuvjrbZmEfgzHnKuk
TLSH
T133265C12FF082596EA0F54F43066B02311A4B08965D8F62675C8AE64F7578F13FA87EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 3008	3684	2026-07-10_c8e0b63569d5860addaf16d6a4b5cb4b_cobalt-strike_glassworm_icedid_vidar.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-10_c8e0b63569d5860addaf16d6a4b5cb4b_cobalt-strike_glassworm_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_c8e0b63569d5860addaf16d6a4b5cb4b_cobalt-strike_glassworm_icedid_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir C:\
  2⤵
  PID:3008