d18b16cbcf15f4ce5d5be8388e4d37e89b0b559cdec3e5ef8405b3edba174c75

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 16:02

Target
2026-07-12_d163f525ff9e2a6450db1826f6604ca5_amadey_elex_glassworm_rhadamanthys_stop.exe
Size 1.5MB
Sample260712-tg24esex6x
SHA256 d18b16cbcf15f4ce5d5be8388e4d37e89b0b559cdec3e5ef8405b3edba174c75
MD5 d163f525ff9e2a6450db1826f6604ca5
SHA1 5e6c97a10b2b3052300c7bc03ca9c1bc92f0fe4d
SHA512 5cf8928d2accf312c2e937683c0228f3e7bd5887a9385906d89061437db12af5f383c046d3dc639d319fd960882a5dbecda8b20b270ebab5c1c6afd75b2b72cc
SSDEEP 24576:dSOcLgrRoNk7BZprsNBM/9/fwK/FTwfCBM0VZeg1mxDh:dNcLgrRokprsNBk9/fw2BwfmM0fQDh
TLSH
T11E758D33FA60F0B2C37649705B95A710B779B4301B1172C7E3A89B1EAE725D16E39A13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 3176	1464	2026-07-12_d163f525ff9e2a6450db1826f6604ca5_amadey_elex_glassworm_rhadamanthys_stop.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-12_d163f525ff9e2a6450db1826f6604ca5_amadey_elex_glassworm_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_d163f525ff9e2a6450db1826f6604ca5_amadey_elex_glassworm_rhadamanthys_stop.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 864
  2⤵
  PID:3176

memory/1464-0-0x00007FFFD00CA000-0x00007FFFD00CB000-memory.dmp

Download

memory/1464-1-0x00007FFFCFDD0000-0x00007FFFD0808000-memory.dmp

Download

memory/1464-2-0x00007FFFCFDD0000-0x00007FFFD0808000-memory.dmp

Download

memory/1464-5-0x00007FFFCFDD0000-0x00007FFFD0808000-memory.dmp

Download

memory/1464-6-0x00007FFFCFDD0000-0x00007FFFD0808000-memory.dmp

Download