4b294c8b862c1f3ce5d54c2d438da2963d9f036491585814059272efbab56291

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 11:43

Target
2026-07-10_7d26da31bce134024f73cbc571b93d04_cobalt-strike_icedid_njrat.exe
Size 261KB
Sample260710-nvpscsby2x
SHA256 4b294c8b862c1f3ce5d54c2d438da2963d9f036491585814059272efbab56291
MD5 7d26da31bce134024f73cbc571b93d04
SHA1 40e350334dc454573012be05597a35429d835e26
SHA512 f092cbc04df00ddd1821b3da8864a9bad4dbd2cf9ccac51a4d04b29f23de7fb0b25ed2aacd60bb75222a5295a68cb5121aed5e74ef784b7a7250f6553320216e
SSDEEP 3072:Qb4h2T68Vaoz+O0q3fkBnuTGglb74rTTPWAUtzfSDOQvRIzPGdkE2dr+aHr5oY4k:Qe2T69P8sB+vIWmD2oadrNohb0jPYU
TLSH
T11B44D021F2D48CDAED76053C5C91A1083A767C84CB35DD3B05A4C76B8EE72A4AD2DDE4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 4988	1432	2026-07-10_7d26da31bce134024f73cbc571b93d04_cobalt-strike_icedid_njrat.exe	98
PID 1432 wrote to memory of 3756	1432	2026-07-10_7d26da31bce134024f73cbc571b93d04_cobalt-strike_icedid_njrat.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-07-10_7d26da31bce134024f73cbc571b93d04_cobalt-strike_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_7d26da31bce134024f73cbc571b93d04_cobalt-strike_icedid_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4988
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:3756

memory/1432-0-0x0000000140000000-0x000000014004A000-memory.dmp

Download

memory/1432-1-0x0000000140000000-0x000000014004A000-memory.dmp

Download